CVE-2026-124016 · Package
NO FIX YET · SEE WHAT TO DO
postal-mime, a JavaScript email parser, becomes very slow on specially crafted multipart emails with deeply nested boundaries. An unauthenticated remote sender can block the Node.js event loop for seconds per message, causing denial of service.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that parse untrusted inbound email with postal-mime in Node.js are exposed, because a single malicious message can stall the event loop. Apps that only parse trusted mail or never handle inbound messages can skip it.
Not affected if no-untrusted-email-input, trusted-mail-only
Who cares email-parsing, node.js, postal-mime
npm ls postal-mimepostal-mime in package.json and lockfiles for any version below 4.2.1postal-mime 4.2.1 (fixed version, per the vulnerability record; the product data lists no ranges)postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.