Zero Radar
← feed
HighVulnerabilityGHSA-f2hq-32vh-53ccupdated 25 Oct 2026, 13:32 UTC

postal-mime email parser can freeze when given crafted headers

A specially crafted email can make the software that reads it stop responding for seconds, which can make a service slow or unavailable. It does not expose or change data.

Fixed in postal-mime 4.0.8Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespostal-mime 4.0.8 · since 25 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends emailCrafted message with many encoded words
  2. 2Email reaches appApp parses it with postal-mime
  3. 3Header decoding stallsQuadratic regex work on joined text
  4. 4Event loop blockedTakes one to twenty seconds per message
  5. ResultService becomes slow or unresponsive

What happened

Decoding RFC 2047 base64 encoded words in mail headers runs in quadratic time, so one message with tens of thousands of such words blocks the Node.js event loop; inline message/rfc822 parts multiply the cost.

Why it is dangerous: A single well-formed message of about 1.6 MB can block the event loop for one to twenty seconds, causing denial of service for services that parse untrusted email. There is no confidentiality or integrity impact.

Are you affected?

You are affected if your application uses postal-mime version 3.0.0 through 4.0.7 to parse untrusted email, including via the exported decodeWords() helper.

Package / productAffected versionsFixed in
postal-mime · npm>= 3.0.0, < 4.0.84.0.8

What to do

  1. Update postal-mime to 4.0.8 or later
  2. If you cannot update yet, lower maxHeadersSize from its 2 MiB default to limit cost per message
  3. Alternatively, parse untrusted mail in a worker process that can be terminated

Timeline

  1. 23 Oct 2026, 21:54 UTC
    Publicly disclosed
  2. 23 Oct 2026, 21:54 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-f2hq-32vh-53cc
CVSS
7.5 / 10
Disclosed
23 Oct 2026, 21:54 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

postal-mime email parser can freeze when given crafted headers · Zero Radar