postal-mime 2.4.5 → 2.4.6

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.4.6](https://github.com/postalsys/postal-mime/compare/v2.4.5...v2.4.6) (2025-10-01)
+
+
+### Bug Fixes
+
+* add security limits for MIME parsing ([defbf11](https://github.com/postalsys/postal-mime/commit/defbf11e85c8233e6ff01a3d6fc10534b784c499))
+
 ## [2.4.5](https://github.com/postalsys/postal-mime/compare/v2.4.4...v2.4.5) (2025-09-29)
 
 

package/README.md

@@ -111,6 +111,8 @@ PostalMime.parse(email, options) -> Promise<ParsedEmail>
         -   `"base64"`
         -   `"utf8"`
         -   `"arraybuffer"` (no decoding, returns `ArrayBuffer`)
+    -   **maxNestingDepth** (number, default: `256`): Maximum allowed MIME part nesting depth. Throws an error if exceeded.
+    -   **maxHeadersSize** (number, default: `2097152`): Maximum allowed total header size in bytes (default 2MB). Throws an error if exceeded.
 
 **Returns**: A Promise that resolves to a structured object with the following properties:
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "postal-mime",
-    "version": "2.4.5",
+    "version": "2.4.6",
     "description": "Email parser for browser environments",
     "main": "./src/postal-mime.js",
     "exports": {

package/postal-mime.d.ts

@@ -1,6 +1,9 @@
 export type RawEmail = string | ArrayBuffer | Uint8Array | Blob | Buffer | ReadableStream;
 
-export type Header = Record<string, string>;
+export type Header = {
+    key: string;
+    value: string;
+};
 
 export type Address = {
     name: string;
@@ -22,7 +25,7 @@ export type Attachment = {
 
 export type Email = {
     headers: Header[];
-    from: Address;
+    from?: Address;
     sender?: Address;
     replyTo?: Address[];
     deliveredTo?: string;
@@ -31,7 +34,7 @@ export type Email = {
     cc?: Address[];
     bcc?: Address[];
     subject?: string;
-    messageId: string;
+    messageId?: string;
     inReplyTo?: string;
     references?: string;
     date?: string;
@@ -56,7 +59,9 @@ declare function decodeWords (
 declare type PostalMimeOptions = {
     rfc822Attachments?: boolean,
     forceRfc822Attachments?: boolean,
-    attachmentEncoding?: "base64" | "utf8" | "arraybuffer"
+    attachmentEncoding?: "base64" | "utf8" | "arraybuffer",
+    maxNestingDepth?: number,
+    maxHeadersSize?: number
 }
 
 declare class PostalMime {

package/src/mime-node.js

@@ -4,20 +4,31 @@ import Base64Decoder from './base64-decoder.js';
 import QPDecoder from './qp-decoder.js';
 
 export default class MimeNode {
-    constructor(opts) {
-        opts = opts || {};
+    constructor(options) {
+        this.options = options || {};
 
-        this.postalMime = opts.postalMime;
+        this.postalMime = this.options.postalMime;
 
-        this.root = !!opts.parentNode;
+        this.root = !!this.options.parentNode;
         this.childNodes = [];
-        if (opts.parentNode) {
-            opts.parentNode.childNodes.push(this);
+
+        if (this.options.parentNode) {
+            this.parentNode = this.options.parentNode;
+
+            this.depth = this.parentNode.depth + 1;
+            if (this.depth > this.options.maxNestingDepth) {
+                throw new Error(`Maximum MIME nesting depth of ${this.options.maxNestingDepth} levels exceeded`);
+            }
+
+            this.options.parentNode.childNodes.push(this);
+        } else {
+            this.depth = 0;
         }
 
         this.state = 'header';
 
         this.headerLines = [];
+        this.headerSize = 0;
 
         this.contentType = {
             value: 'text/plain',
@@ -262,6 +273,14 @@ export default class MimeNode {
                     this.state = 'body';
                     return this.processHeaders();
                 }
+
+                this.headerSize += line.length;
+
+                if (this.headerSize > this.options.maxHeadersSize) {
+                    let error = new Error(`Maximum header size of ${this.options.maxHeadersSize} bytes exceeded`);
+                    throw error;
+                }
+
                 this.headerLines.push(getDecoder().decode(line));
                 break;
             case 'body': {

package/src/postal-mime.js

@@ -6,6 +6,9 @@ import { base64ArrayBuffer } from './base64-encoder.js';
 
 export { addressParser, decodeWords };
 
+const MAX_NESTING_DEPTH = 256;
+const MAX_HEADERS_SIZE = 2 * 1024 * 1024;
+
 export default class PostalMime {
     static parse(buf, options) {
         const parser = new PostalMime(options);
@@ -14,9 +17,14 @@ export default class PostalMime {
 
     constructor(options) {
         this.options = options || {};
+        this.mimeOptions = {
+            maxNestingDepth: this.options.maxNestingDepth || MAX_NESTING_DEPTH,
+            maxHeadersSize: this.options.maxHeadersSize || MAX_HEADERS_SIZE
+        };
 
         this.root = this.currentNode = new MimeNode({
-            postalMime: this
+            postalMime: this,
+            ...this.mimeOptions
         });
         this.boundaries = [];
 
@@ -78,7 +86,8 @@ export default class PostalMime {
 
                     this.currentNode = new MimeNode({
                         postalMime: this,
-                        parentNode: boundary.node
+                        parentNode: boundary.node,
+                        ...this.mimeOptions
                     });
                 }