postal-mime 3.0.0 through 4.0.7: decoding a header made of many joinable RFC 2047 base64 encoded-words re-joins and re-decodes the accumulated text for every word (src/decode-strings), so a crafted email header causes quadratic CPU consumption and denial of service. Fixed in 4.0.8.