[HIGH] zbateson/mail-mime-parser has CRLF header injection via attachment filename

PKSA-f3bq-hwxm-x4yf CVE-2026-61815 GHSA-36h5-qg4p-q2qf

Affected version: >=4.0.0,<4.0.2|<3.0.6

Reported by:
GitHub

[HIGH] zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

PKSA-r8x8-972m-nrc1 CVE-2026-61816 GHSA-f6v3-2qmr-vfjx

Affected version: >=4.0.0,<4.0.2|>=2.0.0,<3.0.6

Reported by:
GitHub