@mavogel/awscdk-rootmail 0.1.22 → 0.1.24

package/node_modules/mailparser/lib/mail-parser.js

@@ -82,27 +82,121 @@ linkify.add('@', {
     }
 });
 
-// Linear equivalent of /<[^<>]+@[^<>]+>/.test(str). The regex backtracks
-// quadratically on a long run of @ characters after a lone <, and the input is a
-// decoded encoded-word bounded only by the header size limit.
-function hasBracketedAddress(str) {
-    let start = -1;
-    // first @ after the current < that has at least one character before it
-    let at = -1;
-    for (let i = 0, len = str.length; i < len; i++) {
-        let chr = str.charAt(i);
-        if (chr === '<') {
-            start = i;
-            at = -1;
-        } else if (chr === '>') {
-            if (start >= 0 && at >= 0 && at < i - 1) {
-                return true;
+// Lists the parameters a header value gives in RFC 2231 form (name*=, name*0= or
+// name*0*=). libmime decodes those while parsing the header, so the result must not go
+// through decodeWords as well: filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D would
+// otherwise come out as "a.exe" while a parser that decodes once sees the encoded word.
+function rfc2231ParamNames(value) {
+    let names = new Set();
+    let quote = false;
+    let escaped = false;
+    let start = 0;
+
+    let addSegment = end => {
+        let segment = value.substring(start, end);
+        let eq = segment.indexOf('=');
+        if (eq < 0) {
+            return;
+        }
+        let match = segment
+            .substring(0, eq)
+            .trim()
+            .toLowerCase()
+            .match(/^(.+?)\*(\d+\*?)?$/);
+        if (match) {
+            names.add(match[1]);
+        }
+    };
+
+    for (let i = 0; i < value.length; i++) {
+        let chr = value.charAt(i);
+        if (escaped) {
+            escaped = false;
+        } else if (chr === '\\') {
+            escaped = true;
+        } else if (chr === '"') {
+            quote = !quote;
+        } else if (chr === ';' && !quote) {
+            addSegment(i);
+            start = i + 1;
+        }
+    }
+    addSegment(value.length);
+
+    return names;
+}
+
+// Deepest element nesting html-to-text is asked to convert. htmlparser2 keeps its open
+// element stack at the front of an array, so parsing alone is quadratic in the nesting
+// depth (200k nested <b> took 9 s), and html-to-text's recursive walk overflows the call
+// stack at about 2000 levels. Real markup stays far below this: Chrome's own parser
+// flattens anything nested deeper than 512 levels.
+const MAX_HTML_NESTING_DEPTH = 1000;
+
+// Elements that never hold content, so a start tag does not open a level
+const HTML_VOID_ELEMENTS = new Set(['area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source', 'track', 'wbr']);
+
+// Elements the HTML parser closes implicitly when a sibling opens (li after li, td after
+// td, p after p), so an unclosed run of them does not nest. They are left out of the depth
+// count: a report with thousands of unclosed table cells is sloppy but common markup
+const HTML_IMPLIED_END_ELEMENTS = new Set(['p', 'li', 'dt', 'dd', 'option', 'optgroup', 'tr', 'td', 'th', 'thead', 'tbody', 'tfoot', 'rt', 'rp']);
+
+function isTagNameChar(code) {
+    return (
+        (code >= 0x61 && code <= 0x7a) || (code >= 0x41 && code <= 0x5a) || (code >= 0x30 && code <= 0x39) || code === 0x2d || code === 0x3a || code === 0x5f
+    );
+}
+
+// Reports whether `html` nests elements deeper than `maxDepth`, in one linear pass that
+// follows what htmlparser2 builds: a start tag opens an element (a trailing "/" does not
+// close it in HTML mode), an end tag closes down to the nearest open element of that name
+// and is ignored otherwise, comments are skipped. Returns as soon as the limit is crossed.
+function exceedsHtmlNestingDepth(html, maxDepth) {
+    let stack = [];
+    let open = new Map(); // element name -> how many of them are on the stack
+    let len = html.length;
+    let i = html.indexOf('<');
+    while (i >= 0) {
+        let pos = i + 1;
+        if (html.startsWith('!--', pos)) {
+            let end = html.indexOf('-->', pos + 3);
+            i = end < 0 ? -1 : html.indexOf('<', end + 3);
+            continue;
+        }
+        let closing = html.charCodeAt(pos) === 0x2f; // "/"
+        if (closing) {
+            pos++;
+        }
+        let nameStart = pos;
+        while (pos < len && isTagNameChar(html.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos === nameStart) {
+            // not a tag, "<" is text here
+            i = html.indexOf('<', pos);
+            continue;
+        }
+        let name = html.slice(nameStart, pos).toLowerCase();
+        let end = html.indexOf('>', pos);
+        if (end < 0) {
+            break;
+        }
+        if (!HTML_VOID_ELEMENTS.has(name) && !HTML_IMPLIED_END_ELEMENTS.has(name)) {
+            if (!closing) {
+                stack.push(name);
+                open.set(name, (open.get(name) || 0) + 1);
+                if (stack.length > maxDepth) {
+                    return true;
+                }
+            } else if (open.get(name)) {
+                let popped;
+                do {
+                    popped = stack.pop();
+                    open.set(popped, open.get(popped) - 1);
+                } while (popped !== name);
             }
-            start = -1;
-            at = -1;
-        } else if (chr === '@' && start >= 0 && at < 0 && i > start + 1) {
-            at = i;
         }
+        i = html.indexOf('<', end + 1);
     }
     return false;
 }
@@ -379,12 +473,17 @@ class MailParser extends Transform {
             switch (key) {
                 case 'content-type':
                 case 'content-disposition':
-                case 'dkim-signature':
+                case 'dkim-signature': {
+                    // a parameter given in RFC 2231 form is decoded by parseHeaderValue already
+                    let rfc2231 = rfc2231ParamNames(value);
                     value = this.libmime.parseHeaderValue(value);
                     if (value.value) {
                         value.value = this.libmime.decodeWords(value.value);
                     }
                     Object.keys((value && value.params) || {}).forEach(key => {
+                        if (rfc2231.has(key)) {
+                            return;
+                        }
                         try {
                             value.params[key] = this.libmime.decodeWords(value.params[key]);
                         } catch (E) {
@@ -392,6 +491,7 @@ class MailParser extends Transform {
                         }
                     });
                     break;
+                }
                 case 'date': {
                     let dateValue = new Date(value);
                     if (isNaN(dateValue)) {
@@ -464,7 +564,12 @@ class MailParser extends Transform {
                 if (!headers.has(key)) {
                     headers.set(key, [].concat(value || []));
                 } else if (Array.isArray(value)) {
-                    headers.set(key, headers.get(key).concat(value));
+                    // appended in place: rebuilding the list with concat for every repeated
+                    // header was quadratic in the number of References lines
+                    let list = headers.get(key);
+                    for (let entry of value) {
+                        list.push(entry);
+                    }
                 } else {
                     headers.get(key).push(value);
                 }
@@ -495,7 +600,9 @@ class MailParser extends Transform {
         headers.forEach((value, key) => {
             if (Array.isArray(value)) {
                 if (singleKeys.includes(key) && value.length) {
-                    headers.set(key, value[value.length - 1]);
+                    // the first occurrence: the one mailsplit built the MIME structure from,
+                    // and the one mail clients display when the header is duplicated
+                    headers.set(key, value[0]);
                 } else if (value.length === 1) {
                     headers.set(key, value[0]);
                 }
@@ -593,38 +700,14 @@ class MailParser extends Transform {
     }
 
     decodeAddresses(addresses) {
-        let processedAddress = new WeakSet();
         for (let i = 0; i < addresses.length; i++) {
             let address = addresses[i];
             address.name = (address.name || '').toString().trim();
 
-            if (!address.address && /^(=\?([^?]+)\?[Bb]\?[^?]*\?=)(\s*=\?([^?]+)\?[Bb]\?[^?]*\?=)*$/.test(address.name) && !processedAddress.has(address)) {
-                let decoded = this.libmime.decodeWords(address.name);
-                // Security fix: only re-parse if decoded text contains angle-bracket-delimited
-                // addresses (e.g. "Name <user@domain>"). Bare decoded text like "attacker@evil.com"
-                // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
-                // encoded-words in addr-spec, and re-parsing fabricates addresses not present
-                // in the original header.
-                if (hasBracketedAddress(decoded)) {
-                    let parsed = addressparser(decoded);
-                    if (parsed.length) {
-                        parsed.forEach(entry => {
-                            processedAddress.add(entry);
-                            addresses.push(entry);
-                        });
-                    }
-
-                    // remove current element
-                    addresses.splice(i, 1);
-                    i--;
-                    continue;
-                } else {
-                    // Treat decoded content as display name only
-                    address.name = decoded;
-                    continue;
-                }
-            }
-
+            // An encoded word decodes into the display name and nothing else, whatever it
+            // decodes to. RFC 2047 section 5 keeps encoded words out of the addr-spec, so a
+            // name that decodes to "CEO" <ceo@bank.com> is still only a name: parsing it
+            // again would report an address the header never carried
             if (address.name) {
                 try {
                     address.name = this.libmime.decodeWords(address.name);
@@ -762,6 +845,7 @@ class MailParser extends Transform {
     getTextContent() {
         let text = [];
         let html = [];
+        let textConversionError = null;
         let processNode = (alternative, level, node) => {
             if (node.showMeta) {
                 let meta = ['From', 'Subject', 'Date', 'To', 'Cc', 'Bcc']
@@ -845,27 +929,34 @@ class MailParser extends Transform {
                         html.push(this.textToHtml(node.textContent));
                     }
                 } else if (node.contentType === 'text/html') {
-                    let failedToParseHtml = false;
                     if ((!alternative && this.hasText) || (node.root && !this.hasText)) {
                         if (this.options.skipHtmlToText) {
                             text.push('');
-                        } else if (node.textContent.length > this.options.maxHtmlLengthToParse) {
-                            this.emit('error', new Error(`HTML too long for parsing ${node.textContent.length} bytes`));
-                            text.push('Invalid HTML content (too long)');
-                            failedToParseHtml = true;
                         } else {
-                            try {
-                                text.push(htmlToText(node.textContent));
-                            } catch (err) {
-                                this.emit('error', new Error('Failed to parse HTML'));
-                                text.push('Invalid HTML content');
-                                failedToParseHtml = true;
+                            // HTML that can not be converted is no reason to lose the message:
+                            // the text stays empty, the HTML is kept and the reason travels with
+                            // the result as textConversionError. An 'error' event here used to
+                            // reject the whole simpleParser() promise, headers and attachments
+                            // included, after burning the CPU the conversion attempt took
+                            let err = null;
+                            if (node.textContent.length > this.options.maxHtmlLengthToParse) {
+                                err = new Error(`HTML too long for parsing ${node.textContent.length} bytes`);
+                            } else if (exceedsHtmlNestingDepth(node.textContent, MAX_HTML_NESTING_DEPTH)) {
+                                err = new Error(`HTML nested deeper than ${MAX_HTML_NESTING_DEPTH} levels`);
+                            } else {
+                                try {
+                                    text.push(htmlToText(node.textContent, { limits: { maxDepth: MAX_HTML_NESTING_DEPTH } }));
+                                } catch (cause) {
+                                    err = new Error('Failed to parse HTML', { cause });
+                                }
+                            }
+                            if (err) {
+                                text.push('');
+                                textConversionError = textConversionError || err;
                             }
                         }
                     }
-                    if (!failedToParseHtml) {
-                        html.push(node.textContent);
-                    }
+                    html.push(node.textContent);
                 }
             }
             alternative = alternative || node.contentType === 'multipart/alternative';
@@ -888,6 +979,9 @@ class MailParser extends Transform {
             this.text = response.text = text.join('\n');
             this.textAsHtml = response.textAsHtml = text.map(part => this.textToHtml(part)).join('<br/>\n');
         }
+        if (textConversionError) {
+            response.textConversionError = textConversionError;
+        }
         return response;
     }
 
@@ -1147,7 +1241,8 @@ class MailParser extends Transform {
                 .map(address => {
                     let str = '';
                     if (address.name) {
-                        str += `"${address.name}"` + (address.group ? ': ' : '');
+                        // a quoted-string, so a quote or backslash inside the name is escaped
+                        str += `"${address.name.replace(/["\\]/g, '\\$&')}"` + (address.group ? ': ' : '');
                     }
                     if (address.address) {
                         let link = address.address;

package/node_modules/mailparser/lib/simple-parser.js

@@ -19,8 +19,8 @@ module.exports = (input, options, callback) => {
         });
     }
 
-    // MailParser may emit a non-fatal 'error' (eg. HTML too long to convert to text) and
-    // still reach 'end', so settle only once: the first error or the result wins
+    // MailParser may emit a non-fatal 'error' and still reach 'end', so settle only once:
+    // the first error or the result wins
     let settled = false;
     let settle = callback;
     callback = (...args) => {
@@ -62,7 +62,7 @@ module.exports = (input, options, callback) => {
 
         if (data.type === 'text') {
             Object.keys(data).forEach(key => {
-                if (['text', 'html', 'textAsHtml'].includes(key)) {
+                if (['text', 'html', 'textAsHtml', 'textConversionError'].includes(key)) {
                     mail[key] = data[key];
                 }
             });

package/node_modules/mailparser/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.39",
+    "version": "3.9.40",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -18,14 +18,14 @@
     ],
     "license": "MIT",
     "dependencies": {
+        "@zone-eu/mailsplit": "5.4.23",
         "encoding-japanese": "2.4.0",
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
-        "libmime": "5.4.8",
+        "libmime": "5.4.9",
         "linkify-it": "5.0.2",
-        "@zone-eu/mailsplit": "5.4.21",
-        "nodemailer": "10.1.1",
+        "nodemailer": "10.1.2",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },

package/node_modules/nodemailer/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## [10.1.2](https://github.com/nodemailer/nodemailer/compare/v10.1.1...v10.1.2) (2026-10-16)
+
+
+### Bug Fixes
+
+* bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint ([e347fa2](https://github.com/nodemailer/nodemailer/commit/e347fa2260a7e342e772a7e187937aa87ac96364))
+
 ## [10.1.1](https://github.com/nodemailer/nodemailer/compare/v10.1.0...v10.1.1) (2026-10-14)
 
 

package/node_modules/nodemailer/dist/cjs/dkim/index.js

@@ -133,8 +133,9 @@ class DKIMSigner {
     }
     createWriteCache() {
         this.output.usingCache = true;
-        // pipe remainings to cache file
-        this.cache = node_fs_1.default.createWriteStream(this.cachePath);
+        // pipe remainings to cache file. It holds the message body and cacheDir is often a
+        // shared directory such as /tmp, so nobody but the owner gets to read it
+        this.cache = node_fs_1.default.createWriteStream(this.cachePath, { mode: 0o600 });
         this.cache.once('error', err => {
             // drain input
             this.relaxedBody.unpipe(this.cache);

package/node_modules/nodemailer/dist/cjs/fetch/index.d.ts

@@ -27,6 +27,8 @@ export interface FetchOptions {
     } | undefined;
     /** Socket inactivity timeout in milliseconds, defaults to 60000, 0 disables it */
     timeout?: number | undefined;
+    /** Time limit for the whole request in milliseconds, redirects included, defaults to 120000, 0 disables it */
+    maxTime?: number | undefined;
     /** Maximum size of the (decoded) response body in bytes, defaults to 64 MB, Infinity disables the limit */
     maxBytes?: number | undefined;
     /** Maximum number of redirects to follow (default 5) */
@@ -37,6 +39,8 @@ export interface FetchOptions {
     redirects?: number | undefined;
     /** Response stream shared across redirects, set by nmfetch itself */
     fetchRes?: FetchResponse | undefined;
+    /** Timestamp the whole request has to be done by, shared across redirects, set by nmfetch itself */
+    deadline?: number | undefined;
 }
 /**
  * The stream nmfetch returns. The response body is piped into it, the status code and
@@ -50,6 +54,7 @@ declare function nmfetch(url: string, options?: FetchOptions): FetchResponse;
 declare namespace nmfetch {
     var Cookies: typeof import("./cookies.js").default;
     var DEFAULT_TIMEOUT: number;
+    var DEFAULT_MAX_TIME: number;
 }
 type CookiesJar = Cookies;
 /**

package/node_modules/nodemailer/dist/cjs/fetch/index.js

@@ -49,6 +49,10 @@ const objects_js_1 = require("../shared/objects.js");
 const MAX_REDIRECTS = 5;
 // a stalled server would otherwise hold the request, and whatever waits on it, open forever
 const DEFAULT_TIMEOUT = 60 * 1000;
+// the inactivity timeout above is reset by every byte, so a server dripping one within each
+// window could still hold the request, and the message being built from it, open for as
+// long as it liked. The whole request, redirects included, has to be done within this
+const DEFAULT_MAX_TIME = 2 * 60 * 1000;
 // the body is usually buffered in memory by the caller, so an unbounded download is refused
 const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
 // Only genuine TLS settings are taken from options.tls. That object reaches us straight
@@ -126,6 +130,12 @@ function nmfetch(url, options) {
     options.cookies = options.cookies || new cookies_js_1.default();
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
+    if (!options.deadline) {
+        options.maxTime = typeof options.maxTime === 'number' && options.maxTime >= 0 ? options.maxTime : DEFAULT_MAX_TIME;
+        // the one deadline is shared with the requests the redirects lead to, every hop
+        // gets the time that is left rather than starting over
+        options.deadline = options.maxTime ? Date.now() + options.maxTime : 0;
+    }
     const fetchRes = options.fetchRes;
     const parsed = parseFetchUrl(url);
     if (!parsed) {
@@ -271,12 +281,22 @@ function nmfetch(url, options) {
         });
         return fetchRes;
     }
+    // the whole request has to be done by options.deadline, see maxTime. The timer is
+    // released on every way out of the request, so it never outlives it
+    let deadlineTimer;
+    const clearDeadline = () => {
+        if (deadlineTimer) {
+            clearTimeout(deadlineTimer);
+            deadlineTimer = undefined;
+        }
+    };
     // reports the first failure of this request on fetchRes and releases the request
     const fail = (err, sourceUrl = url) => {
         if (finished) {
             return;
         }
         finished = true;
+        clearDeadline();
         setFetchCode(err);
         err.sourceUrl = sourceUrl;
         fetchRes.emit('error', err);
@@ -286,10 +306,16 @@ function nmfetch(url, options) {
     if (timeout) {
         req.setTimeout(timeout, () => fail(new Error('Request Timeout')));
     }
+    if (options.deadline) {
+        deadlineTimer = setTimeout(() => fail(new Error('Request exceeded the allowed ' + options.maxTime + ' ms')), Math.max(options.deadline - Date.now(), 1));
+        // a pending deadline is no reason to keep the process alive
+        deadlineTimer.unref();
+    }
     req.on('error', (err) => fail(err));
     // a consumer that destroys the response stream before it ended does not want the rest of
     // the body, release the request now instead of when the timeout fires
     fetchRes.once('close', () => {
+        clearDeadline();
         if (finished || fetchRes.readableEnded) {
             return;
         }
@@ -358,6 +384,7 @@ function nmfetch(url, options) {
             // this request is done with, release it so its socket and timeout do not
             // outlive it and report a late error on the shared fetchRes
             finished = true;
+            clearDeadline();
             res.resume();
             req.abort();
             return nmfetch(redirectUrl, options);
@@ -368,6 +395,8 @@ function nmfetch(url, options) {
             return fail(new Error('Invalid status code ' + res.statusCode));
         }
         res.on('error', (err) => fail(err));
+        // the response is in, whatever is left of it is in memory and no longer on the network
+        res.once('end', () => clearDeadline());
         const maxBytes = typeof options.maxBytes === 'number' && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_BYTES;
         const source = inflate || res;
         let received = 0;
@@ -405,6 +434,7 @@ function nmfetch(url, options) {
 }
 nmfetch.Cookies = cookies_js_1.default;
 nmfetch.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
+nmfetch.DEFAULT_MAX_TIME = DEFAULT_MAX_TIME;
 exports.default = nmfetch;
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/node_modules/nodemailer/dist/cjs/mailer/index.js

@@ -398,9 +398,12 @@ class Mail extends node_events_1.EventEmitter {
                 return callback(err);
             }
             let cidCounter = 0;
+            // the media type is a bounded token: a quote, whitespace, '>' or '<' ends the
+            // attribute value and with it the type, so one img tag never scans ahead to a
+            // ';' that belongs to a later tag, which was quadratic
             html = (html || '')
                 .toString()
-                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
+                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;"'<>\s]{1,255});[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
                 const cid = node_crypto_1.default.randomBytes(10).toString('hex') + '@localhost';
                 if (!mail.data.attachments) {
                     mail.data.attachments = [];

package/node_modules/nodemailer/dist/cjs/mailer/mail-message.d.ts

@@ -23,7 +23,11 @@ export interface SendMailOptions extends MailComposerOptions {
     dsn?: SMTPEnvelopeDsn | undefined;
     /** SMTP transports: RFC 8689, send the REQUIRETLS parameter with MAIL FROM */
     requireTLSExtensionEnabled?: boolean | undefined;
-    /** SMTP transports: per-message authentication settings, used instead of the transport level auth */
+    /**
+     * SMTP transports: per-message authentication settings, used instead of the transport level auth.
+     * Only the credential fields are taken from it (type, user, pass, accessToken, refreshToken, expires),
+     * the token endpoint and client settings stay those of the transport
+     */
     auth?: SMTPTransportAuthOptions | undefined;
     /** SES transport: extra SendEmailCommand parameters merged into the API call */
     ses?: SESSendEmailRequest | undefined;

package/node_modules/nodemailer/dist/cjs/mime-funcs/index.js

@@ -186,26 +186,38 @@ function encodeWord(data, mimeWordEncoding, maxLength) {
  */
 function encodeWords(value, mimeWordEncoding, maxLength, encodeAll) {
     maxLength = maxLength || 0;
-    // find first word with a non-printable ascii or special symbol in it
-    const firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
-    if (!firstMatch) {
+    // find the first and the last character that needs encoding, a quote or anything outside
+    // printable ascii. A scan rather than a regex: matching the last such word with a
+    // backtracking pattern took quadratic time on a long word of non-ascii characters
+    let firstSpecial = -1;
+    let lastSpecial = -1;
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code === 0x22 || code >= 0x80) {
+            if (firstSpecial < 0) {
+                firstSpecial = i;
+            }
+            lastSpecial = i;
+        }
+    }
+    if (firstSpecial < 0) {
         return value;
     }
     if (encodeAll) {
         // if it is requested to encode everything or the string contains something that resebles encoded word, then encode everything
         return encodeWord(value, mimeWordEncoding, maxLength);
     }
-    // find the last word with a non-printable ascii in it
-    const lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
-    if (!lastMatch) {
-        // should not happen
-        return value;
+    // encode from the start of the word holding the first such character to the end of the
+    // word holding the last one, so the encoded words stay separated from the plain text by
+    // the whitespace that was already there
+    let startIndex = firstSpecial;
+    while (startIndex > 0 && !/\s/.test(value.charAt(startIndex - 1))) {
+        startIndex--;
+    }
+    let endIndex = lastSpecial + 1;
+    while (endIndex < value.length && !/\s/.test(value.charAt(endIndex))) {
+        endIndex++;
     }
-    const startIndex = firstMatch.index +
-        (firstMatch[0].match(/[^\s]/) || {
-            index: 0
-        }).index;
-    const endIndex = lastMatch.index + (lastMatch[1] || '').length;
     return ((startIndex ? value.substr(0, startIndex) : '') +
         encodeWord(value.substring(startIndex, endIndex), mimeWordEncoding || 'Q', maxLength) +
         (endIndex < value.length ? value.substr(endIndex) : ''));