CVE-2026-61815: zbateson/mail-mime-parser has CRLF header injection via attachment filename

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.