postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

影響: npm:postal-mime >= 3.0.0, < 4.0.8 → 4.0.8

Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rf…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 06:54, GitHub Advisory Database에서 "postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js.