4.0.4

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @iam-niranjan:
  • maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
  • maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
  • maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.

Reported by @iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.