GHSA-49pc-8936-wvfp

Suggest an improvement
Source
https://github.com/advisories/GHSA-49pc-8936-wvfp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-49pc-8936-wvfp/GHSA-49pc-8936-wvfp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-49pc-8936-wvfp
Aliases
Published
2026-02-20T21:14:49Z
Modified
2026-02-23T22:53:00.479537Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused
Details

Impact

Email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected.

Patches

Yes, the issue has been patched. Users should upgrade to v1.5.1 or later.

Workarounds

If upgrading immediately is not possible, instantiate a new client for each send:

const client = new Lettermint({ apiKey: process.env.LETTERMINT_API_KEY });
await client.email.to('...').subject('...').html('...').send();

This ensures no state is carried over between sends.

Database specific 
{
    "nvd_published_at": "2026-02-21T11:15:57Z",
    "github_reviewed_at": "2026-02-20T21:14:49Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-488"
    ]
}
References

Affected packages

npm / lettermint

Package

Name
lettermint
View open source insights on deps.dev
Purl
pkg:npm/lettermint

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-49pc-8936-wvfp/GHSA-49pc-8936-wvfp.json"