{"answers":{"affected":"2 open source packages ship an affected version, including postal-mime.","exploited":"There is no known exploitation of GHSA-f2hq-32vh-53cc in the wild and no public exploit code.","fix":"Upgrade postal-mime to 4.0.8 or later.","what":"GHSA-f2hq-32vh-53cc is a vulnerability in postal-mime, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-f2hq-32vh-53cc and fix it if it is affected.\n\nWhat it is: GHSA-f2hq-32vh-53cc is a vulnerability in postal-mime, published on 23 Oct 2026. \nExploitation: There is no known exploitation of GHSA-f2hq-32vh-53cc in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- postal-mime (npm): affected from 3.0.0; fixed in 4.0.8\n- postal-mime (npm): affected from 3.0.0; fixed in 4.0.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-f2hq-32vh-53cc/ (Markdown: https://insights.sbomify.com/GHSA-f2hq-32vh-53cc/index.md)","id":"GHSA-f2hq-32vh-53cc","markdown":"https://insights.sbomify.com/GHSA-f2hq-32vh-53cc/index.md","name":"GHSA-f2hq-32vh-53cc","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget.\n\nAny application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported `decodeWords()` helper, is affected. There is no confidentiality or integrity impact.\n\n### Patches\n\nFixed in 4.0.8. The pad check now tracks the last appended word instead of testing the joined text, so decoding is linear in the header length. The same release also counts the parts and header bytes of inline `message/rfc822` sub-messages against the limits of the message as a whole, counts every header line for at least 64 bytes of `maxHeadersSize`, and adds a scaling test that measures every stage of the parser at two input sizes.\n\n### Workarounds\n\nLower `maxHeadersSize` from its 2 MiB default to bound the cost per message, or parse untrusted mail in a worker that can be terminated.\n\n### Credits\n\nReported by Felipe Fernández.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","id":"GHSA-f2hq-32vh-53cc","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["4.0.8"],"introduced":["3.0.0"],"last_affected":[],"package":"postal-mime","purl":null,"source":"GHSA-f2hq-32vh-53cc"},{"ecosystem":"npm","fixed":["4.0.8"],"introduced":["3.0.0"],"last_affected":[],"package":"postal-mime","purl":"pkg:npm/postal-mime","source":"GHSA-f2hq-32vh-53cc"}],"products":null,"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-f2hq-32vh-53cc/"}