[HIGH] zbateson/mail-mime-parser has CRLF header injection via attachment filename

PKSA-f3bq-hwxm-x4yf CVE-2026-61815 GHSA-36h5-qg4p-q2qf

Affected package: zbateson/mail-mime-parser

Affected version: >=4.0.0,<4.0.2|<3.0.6

Reported by:
GitHub