AIKIDO-2026-297362

TL;DR

postal-mime parses inline message/rfc822 parts by creating a new parser instance for each nesting level, and every level retains the whole nested message. No recursion limit applies to these sub-parsers, so a small email with deeply nested message/rfc822 parts drives unbounded memory growth and can crash the parsing process with an out-of-memory error. The fix caps the recursion depth and emits parts past the limit as ordinary attachments, and it also validates the parser resource-limit options. This bounds memory use when parsing untrusted messages.