CVE-2026-124016
postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.
| CWE | CWE-407 |
| Vendor | postalsys |
| Product | postal-mime |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for postalsys postal-mime
Be the first to know when new medium vulnerabilities affecting postalsys postal-mime are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
postalsys / postal-mime
0 < 4.2.1
References
Credits
Arjun Jain