GHSA-F2HQ-32VH-53CC

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

Workarounds

Lower maxHeadersSize from its 2 MiB default to bound the cost per message, or parse untrusted mail in a worker that can be terminated.

Credits

Reported by Felipe Fernández.

Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rfc822 parts multiplied the cost, since each nested message carried its own header budget.

Any application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported decodeWords() helper, is affected. There is no confidentiality or integrity impact.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

GHSA-F2HQ-32VH-53CC has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.0.8); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline message/rfc822 sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of maxHeadersSize, and adds a scaling test that measures every stage of the parser at two input sizes.

1. What is GHSA-F2HQ-32VH-53CC? GHSA-F2HQ-32VH-53CC is a high-severity uncontrolled resource consumption vulnerability in postal-mime (npm), affecting versions >= 3.0.0, < 4.0.8. It is fixed in 4.0.8. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
2. How severe is GHSA-F2HQ-32VH-53CC? GHSA-F2HQ-32VH-53CC has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of postal-mime are affected by GHSA-F2HQ-32VH-53CC? postal-mime (npm) versions >= 3.0.0, < 4.0.8 is affected.
4. Is there a fix for GHSA-F2HQ-32VH-53CC? Yes. GHSA-F2HQ-32VH-53CC is fixed in 4.0.8. Upgrade to this version or later.
5. Is GHSA-F2HQ-32VH-53CC exploitable, and should I be worried? Whether GHSA-F2HQ-32VH-53CC is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-F2HQ-32VH-53CC is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-F2HQ-32VH-53CC? Upgrade postal-mime to 4.0.8 or later.