Do I need an antistatic bag when mailing a CPU?

You will probably have better luck finding Pink Poly than ESD bags. Bubble wrap alone is not fine, neither is regular foam(you need ESD-safe foam). If you are shipping this and want the buyer to actually get a working CPU the proper care needs to be taken in the shipping process.

If you truly can't find it locally and can't wait to order it online, I would ask around at say a Big box store or a place that installs electronics/car stereos they may have some discarded packing materials. Also, check with a local shipping store like UPS/Mailboxesetc. They may have pink poly or pink poly bubble wrap.

The guy above claiming cotton is crazy, ignore him. Cotton is most certainly not antistatic and actually holds charge more readily than air, making static gather insider it and increasing the amplitude of any discharge from hands etc as a result.

(Rub a balloon on your cotton jumper and watch it stick to it if you dont believe me)

The bubble-wrap should be fine. But have something like a piece of foam where you can stick it in with the contacts (if it is a sockel with needle contacts). The way where it can get dangerous is with electric discharges (statics). This is what the anti-static bag is for. People's hands are often charged with static energy. But if the receiver is very careful and not statically charged, everything should be fine.