AIKIDO-2025-10871

TL;DR

Affected versions of this package are vulnerable to a Denial of Service (DoS) attack caused by deeply nested address groups in email headers. A malicious header such as g0: g1: g2: ... gN: user@example.com; can trigger uncontrolled recursion in the address parser, eventually causing a stack overflow and crashing the application. The fix introduces a recursion-depth limit (MAX_NESTED_GROUP_DEPTH = 50), which safely aborts parsing when the structure becomes too deeply nested. This mirrors the mitigation previously applied to the Nodemailer address parser.