CVE-2026-124016

Name of the Vulnerable Software and Affected Versions postal-mime versions prior to 4.2.1

Description An algorithmic complexity issue allows unauthenticated remote attackers to cause excessive CPU consumption. By crafting deeply nested multipart email messages where boundary lines share long prefixes with open boundaries, attackers can block the Node.js event loop for several seconds per message. This occurs within the processLine() function, where the parsing cost scales based on the nesting depth (up to the default maxNestingDepth of 256) and the shared prefix length.

Recommendations Update postal-mime to version 4.2.1 or later.