Description
Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words.
Recommendation
Update the postal-mime package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.0, < 4.0.8
- Patched version(s): 4.0.8
References
Could your website be exposed too?
SmartScanner can check your website for postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields - CVE-2026-49250
- PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled - Vulnerability
- Insufficient validation when decoding a Socket.IO packet - CVE-2023-32695
- Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection - CVE-2026-44486
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026