{"items":[{"id":"NVI-00010602","kind":"vulnerability","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2hq-32vh-53cc"],"plain_summary":"GitHub lists this reviewed advisory for postal-mime. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-62c373e9ffcfce2b443158f97ac4f3dd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.0.8 for postal-mime. Confirm the publisher’s latest guidance.","source_ids":["sr-475b89629a23332f5bf6d07d3ec697d2"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-23T21:54:37.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-62c373e9ffcfce2b443158f97ac4f3dd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-62c373e9ffcfce2b443158f97ac4f3dd","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2hq-32vh-53cc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:08.657Z"},{"id":"sr-475b89629a23332f5bf6d07d3ec697d2","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f2hq-32vh-53cc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-04T10:00:39.068Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-62c373e9ffcfce2b443158f97ac4f3dd"],"technology":"postal-mime","known_exclusions":[],"conditions_summary":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.\n\n### Patches\n\nFixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that me","public_affected_ranges":[">= 3.0.0, < 4.0.8"]},{"certainty":"source_listed","source_ids":["sr-475b89629a23332f5bf6d07d3ec697d2"],"technology":"postal-mime","known_exclusions":[],"conditions_summary":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.\n\n### Patches\n\nFixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that me","public_affected_ranges":["SEMVER: introduced 3.0.0; fixed 4.0.8"]}],"null_published_at":"2026-11-05T03:52:54.735Z","source_updated_at":"2026-10-23T21:54:37.000Z","source_disclosed_at":"2026-10-23T21:54:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:07:08.657Z"},{"id":"NVI-00010602","kind":"vulnerability","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2hq-32vh-53cc"],"plain_summary":"GitHub lists this reviewed advisory for postal-mime. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-62c373e9ffcfce2b443158f97ac4f3dd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-23T21:54:37.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-62c373e9ffcfce2b443158f97ac4f3dd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-62c373e9ffcfce2b443158f97ac4f3dd","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2hq-32vh-53cc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:08.657Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-62c373e9ffcfce2b443158f97ac4f3dd"],"technology":"postal-mime","known_exclusions":[],"conditions_summary":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.\n\n### Patches\n\nFixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that me","public_affected_ranges":[">= 3.0.0, < 4.0.8"]}],"null_published_at":"2026-10-31T22:27:09.625Z","source_updated_at":"2026-10-23T21:54:37.000Z","source_disclosed_at":"2026-10-23T21:54:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:08.657Z"}],"next_cursor":null,"snapshot_revision":"42594"}