ETK-2026-1965Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1965",
  "cve_id": null,
  "display_id": "ETK-2026-1965",
  "ghsa_id": "GHSA-f2hq-32vh-53cc",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic header decoding denial of service in postal-mime",
  "summary": "postal-mime 3.0.0 through 4.0.7 can spend excessive CPU time decoding email headers containing many joinable RFC 2047 encoded words. An attacker able to submit email that the application parses can block the event loop and cause denial of service.",
  "mitigation": "Upgrade postal-mime to version 4.0.8. Until upgraded, lower maxHeadersSize and parse untrusted mail in a worker that can be terminated.",
  "vendor": "npm",
  "product": "npm:postal-mime",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 4.0.8"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.0.8"
      ],
      "package_name": "postal-mime",
      "purl": "pkg:npm/postal-mime"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.507207066666666,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T10:08:36+00:00",
      "days": -3.4022526633912036,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T19:47:50.803643+00:00",
      "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-f2hq-32vh-53cc"
    }
  }
}