Dashboard / CVE-2026-124016

CVE-2026-124016

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 74/100
Published: 2026-11-10 Modified: 2026-11-13 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: None
VI: None
VA: Low

Description

postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
postalsys postal-mime 0 < 4.2.1
postalsys postal-mime 0 < 4.2.1
postalsys postal-mime 0 < 4.2.1

References & Advisories (3)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.61%
Raw Score 0.006090
Percentile 49.8%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00609
2026-11-13
0.00609
2026-11-12
0.00609

Intelligence Sources

mitre ref →
nvd ref →

External Links