Homepage

emailjs-mime-parser@2.0.5 vulnerabilities

Parse a mime tree, no magic included.

  • latest version

    2.0.7

  • first published

    8 years ago

  • latest version published

    5 years ago

  • licenses detected

  • View emailjs-mime-parser package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the emailjs-mime-parser package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Denial of Service (DoS)

    emailjs-mime-parser is an email parser.

    Affected versions of this package are vulnerable to Denial of Service (DoS) via a crafted email containing a few million multiparts.

    MIME (Multipurpose Internet Mail Extentions) is an internet standard that extends the format of email to support: Non-ACSII character sets, non-text attachments, and more.

    Most Node.js MIME decoders do not validate the number of multiparts they are willing to decode, allowing an attacker to send a crafted email containing a few million multiparts, which will then block the Node.js event loop for tens of seconds, explode RAM usage, and cause an out of memory crash.

    How to fix Denial of Service (DoS)?

    Upgrade emailjs-mime-parser to version 2.0.74 or higher.

    <2.0.74
    Go back to all versions of this package