The vulnerability in zbateson/mail‑mime-parser allows an attacker to create a crafted MIME message that forces the parser to consume excessive CPU time or memory, potentially exhausting system resources and triggering a denial of service. Three independent parsing paths are super‑linear, so even messages under 2 MB can trigger seconds of CPU use or hundreds of megabytes to multi‑gigabyte memory usage, leading to out‑of‑memory termination. The parser pays this cost when content is first accessed via getAllParts() or when content is read, making the attack possible before full message processing is completed.

Versions of zbateson/mail‑mime-parser from 2.0.0 up to but not including 3.0.6 and 4.0.2 are impacted. All 2.x releases are also affected and are end‑of‑life, receiving no further fixes. The issue does not affect earlier 1.x releases that use a different parser.

The CVSS score of 7.5 indicates a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a malicious message to any application that parses untrusted mail with the affected library. Because the resource consumption is super‑linear, simply limiting message size is insufficient; the request will still fail once the parser’s internal cost is triggered. Shielding the parser from untrusted input and constraining execution time or memory limits mitigate risk until a patch is applied.