v4.2.1

4.2.1 (2026-11-10)

Summary

A security release. A deeply nested multipart message could make boundary matching cost the nesting depth times the message size, and the address parser read some sender domains differently from RFC 5322 parsers.

Who should upgrade

Everyone who parses untrusted mail with postal-mime, and anyone who shows or makes decisions on from.address.

Behavior changes

• Whitespace or a comment beside a dot of an address domain is now folding whitespace, as RFC 5322 obs-domain and Python read it: ceo@victim.example .other.example is ceo@victim.example.other.example, no longer ceo@victim.example with the rest in the name. Only SP, HTAB and folds count, other Unicode spaces still end the domain.
• An address holding a control character now has an empty address instead of one with the character silently removed. A display name still has the character left out.

Highlights

• Body lines starting with -- are looked up among the open boundaries instead of being compared with each one in turn, so parse cost no longer grows with nesting depth.
• The address parser fix is shared with nodemailer, so both keep reading address headers the same way.

Bug Fixes

• look a boundary line up instead of comparing it with every open boundary (3c3fd9e)
• read whitespace and comments around a dot of the domain as CFWS (6467257)