postal-mime

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)

Severity distribution (all time)

1vulnerability

Critical0 (0.0%)
High1 (100.0%)
Medium0 (0.0%)
Moderate0 (0.0%)
Low0 (0.0%)

Monthly breakdown

Known vulnerabilities affecting postal-mime, based on data from OSV.

Filter by severitySort by

Vulnerabilities affecting postal-mime
ID	Severity	Summary	Affected versions	Published	Source
GHSA-f2hq-32vh-53cc	High	postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own heade	`>= 3.0.0, < 4.0.8`	2026-10-23	GitHub (opens in a new tab)

GHSA-f2hq-32vh-53ccHigh
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
- >= 3.0.0, < 4.0.8
2026-10-23GitHub (opens in a new tab)
### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own heade