GHSA-f2hq-32vh-53cc: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as =?utf-8?B?QUJD?= repeated tens of thousands of times in a Subject, From, To, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline message/rfc822 parts multiplied the cost, since each nested message carried its own header budget.

Any application that parses untrusted mail with postal-mime 3.0.0 through 4.0.7, including the exported decodeWords() helper, is affected. There is no confidentiality or integrity impact.