postal-mime: Algorithmic complexity denial of service in multipart parsing
Summary
postal-mime, an email parsing library for Node.js, browsers and serverless environments, has an algorithmic complexity flaw in its PostalMime.processLine() function. Versions before 4.2.1 compare body lines that start with two hyphens against every open multipart boundary, so parse cost grows with nesting depth and message size. An unauthenticated remote attacker who can deliver a crafted, deeply nested email to an application that parses untrusted mail with postal-mime can block the Node.js event loop for seconds per message.
Affected
- postal-mime versions before 4.2.1 (advisory lists <= 4.2.0)
Fixed in
- Upgrade to postal-mime 4.2.1 or later (released 2026-11-10).
Workaround
Unknown. The maxNestingDepth option may limit nesting but has not been confirmed as a mitigation for this CVE.
Exploitation
- CISA SSVC: exploitation status PoC, automatable yes, technical impact partial.
- The vendor advisory includes a proof of concept.
- No reports of exploitation in the wild found; KEV: No.
Our recommendation
- Identify applications that use postal-mime and check their versions.
- Upgrade to postal-mime 4.2.1 or later and redeploy affected services.
- Until patched, limit inbound message size and parse time, and run mail parsing in a worker or separate process so a stalled parse does not block the main service.
- Monitor for event-loop stalls and CPU spikes in mail-processing services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- postal-mime release v4.2.1 github.com
- GHSA-q8wm-54mj-r36p advisory github.com
- VulnCheck advisory www.vulncheck.com
- CVE Record CVE-2026-124016 www.cve.org
- postal-mime on npm www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:57.
Original description (NVD)
postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.
NVD references (4)
- https://github.com/postalsys/postal-mime/releases/tag/v4.2.1
- https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p
- https://www.vulncheck.com/advisories/postal-mime-algorithmic-complexity-dos-via-processline
- https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.