postal-mime: Quadratic CPU DoS when decoding headers with many joinable RFC 2047 base64 encoded words (no CVE)
Severity: high · Patch status: patched · Since 2026-10-18
postal-mime versions 3.0.0 through 4.0.7 suffer from a quadratic CPU consumption flaw (CWE-400/CWE-407) when decoding headers containing long runs of joinable RFC 2047 base64 encoded words, e.g. repeated =?utf-8?B?...?= tokens in Subject, From, To, filenames or descriptions. The join check ran a regex over the accumulated text for every word, so a single well-formed ~1.6 MB message could block the event loop for 1–20 seconds, and inline message/rfc822 parts multiplied the cost via per-message header budgets. Any application parsing untrusted mail with affected versions, including the exported decodeWords() helper, is exposed; no confidentiality or integrity impact. Fixed in 4.0.8 with linear-time decoding, plus stricter limits on nested message parts and header sizes. No exploitation known.
What to do
- Upgrade postal-mime to 4.0.8 or later
- Until upgraded, lower maxHeadersSize from the 2 MiB default to bound per-message cost
- Parse untrusted mail in a terminable worker process to contain event-loop blocking
- Audit mail-parsing paths, including use of the exported decodeWords() helper, for exposure to untrusted input
Fixed versions
Sources
All live incidents on Threat Watch
