AIKIDO-2026-297362
postal-mime is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
postal-mimeTL;DR
postal-mime parses inline message/rfc822 parts by creating a new parser instance for each nesting level, and every level retains the whole nested message. No recursion limit applies to these sub-parsers, so a small email with deeply nested message/rfc822 parts drives unbounded memory growth and can crash the parsing process with an out-of-memory error. The fix caps the recursion depth and emits parts past the limit as ordinary attachments, and it also validates the parser resource-limit options. This bounds memory use when parsing untrusted messages.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse untrusted email messages that may contain nested inline message/rfc822 parts.
Background info
postal-mime is vulnerable to Denial of Service (DoS) in versions 1.0.8 - 2.7.5.
How to fix this
Upgrade the postal-mime library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant