The Lettermint Node.js SDK fails to clear email properties between successive .send() calls when the same client instance is reused. Properties such as to, subject, html, text, and attachments from a previous message remain attached to the next message, allowing confidential content or recipient addresses to be sent to unintended recipients. This flaw can expose sensitive email content and user addresses and may compromise confidentiality for applications that send transactional emails in rapid succession.

The vulnerability affects the Lettermint Node.js SDK (lettermint:lettermint-node) in all releases prior to 1.5.1, specifically version 1.5.0 and earlier. Developers using these versions in Node.js environments should verify the installed SDK version.

The CVSS score is 4.7, indicating moderate severity. The EPSS score is below 1%, suggesting a low exploitation likelihood at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating or using a single client instance and performing multiple sends; the second or later send will unintentionally leak data from the previous send. There are no additional prerequisites beyond normal application logic that reuses the client, making the attack path relatively straightforward.