{"id":"ghsa-ghsa-f2hq-32vh-53cc","seq":661305,"kind":"advisory","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f2hq-32vh-53cc","summary":"影響: npm:postal-mime >= 3.0.0, < 4.0.8 → 4.0.8\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rf…","severity":"high","techs":["nodejs"],"cves":[],"tags":["GHSA-f2hq-32vh-53cc","postal-mime"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:54:36.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}