Vulnerabilities

TI-2026-85057 CVE-2026-121946 · GHSA-5gqw-c8wj-82xp

CRLF header injection in zbateson mail-mime-parser message builders

HIGH 70

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-11-04 Fixed in 3.0.9, 4.0.6 CWE-93

TI-2026-44241 CVE-2026-61816 · GHSA-f6v3-2qmr-vfjx

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

HIGH 72

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00393 Published 2026-09-24 Fixed in 3.0.6, 4.0.2 CWE-400

TI-2026-44240 CVE-2026-61815 · GHSA-36h5-qg4p-q2qf

zbateson/mail-mime-parser has CRLF header injection via attachment filename

LOW 37

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00178 Published 2026-09-24 Fixed in 3.0.6, 4.0.2 CWE-93

Vulnerabilities

Filters

CRLF header injection in zbateson mail-mime-parser message builders

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

zbateson/mail-mime-parser has CRLF header injection via attachment filename