@mavogel/awscdk-rootmail 0.1.8 → 0.1.10

package/node_modules/mailparser/lib/mail-parser.js

@@ -34,6 +34,16 @@ const MAX_LINKIFY_SEGMENT_LENGTH = 4096;
 const MAX_LINKIFY_HOST_LABELS = 6;
 const MAX_LINKIFY_WORK = 768 * 1024 * 1024; // shared by all text parts of a message
 
+// Default upper bound for the total length of the URLs updateImageLinks() writes
+// into the HTML (options.maxInlinedImagesSize). simpleParser inlines every cid:
+// reference as a full data: URL, so a small message repeating a reference to
+// one image thousands of times would otherwise grow the HTML past the maximum
+// string length. References beyond the budget are left as cid: links.
+const MAX_INLINED_IMAGES_SIZE = 20 * 1024 * 1024;
+
+// List-* header names that must not become keys of the plain list object
+const UNSAFE_LIST_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 linkify
     .tlds(tlds) // Reload with full tlds list
     .tlds('onion', true) // Add unofficial `.onion` domain
@@ -72,6 +82,31 @@ linkify.add('@', {
     }
 });
 
+// Linear equivalent of /<[^<>]+@[^<>]+>/.test(str). The regex backtracks
+// quadratically on a long run of @ characters after a lone <, and the input is a
+// decoded encoded-word bounded only by the header size limit.
+function hasBracketedAddress(str) {
+    let start = -1;
+    // first @ after the current < that has at least one character before it
+    let at = -1;
+    for (let i = 0, len = str.length; i < len; i++) {
+        let chr = str.charAt(i);
+        if (chr === '<') {
+            start = i;
+            at = -1;
+        } else if (chr === '>') {
+            if (start >= 0 && at >= 0 && at < i - 1) {
+                return true;
+            }
+            start = -1;
+            at = -1;
+        } else if (chr === '@' && start >= 0 && at < 0 && i > start + 1) {
+            at = i;
+        }
+    }
+    return false;
+}
+
 class IconvDecoder extends Transform {
     constructor(Iconv, charset) {
         super();
@@ -185,8 +220,6 @@ class MailParser extends Transform {
 
         this.attachmentList = [];
 
-        this.boundaries = [];
-
         this.textTypes = ['text/plain', 'text/html'].concat(!this.options.keepDeliveryStatus ? 'message/delivery-status' : []);
 
         this.decoder = this.getDecoder();
@@ -236,7 +269,7 @@ class MailParser extends Transform {
                 decodeStream(charset) {
                     // resolve charset aliases (eg. iso-8859-8-i -> ISO-8859-8) via libmime's canonical table
                     charset = libmime.normalizeCharset((charset || 'ascii').toString());
-                    if (/^jis|^iso-?2022-?jp|^EUCJP/i.test(charset)) {
+                    if (/^jis|^iso-?2022-?jp/i.test(charset)) {
                         // special case not supported by iconv-lite
                         return new JPDecoder(charset);
                     }
@@ -302,7 +335,12 @@ class MailParser extends Transform {
         if (this.finished) {
             return this.cleanup(done);
         }
-        this.waitingEnd = () => {
+        this.waitingEnd = err => {
+            // runs once, either on a splitter error after end of input or when the splitter ends
+            this.waitingEnd = false;
+            if (err) {
+                return done(err);
+            }
             this.cleanup(done);
         };
     }
@@ -479,6 +517,10 @@ class MailParser extends Transform {
     }
 
     parseListHeader(key, value) {
+        if (UNSAFE_LIST_KEYS.has(key)) {
+            // would replace the prototype of (or shadow) the normalized list object
+            return false;
+        }
         let addresses = addressparser(value);
         let response = {};
         let data = addresses
@@ -563,7 +605,7 @@ class MailParser extends Transform {
                 // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
                 // encoded-words in addr-spec, and re-parsing fabricates addresses not present
                 // in the original header.
-                if (/<[^<>]+@[^<>]+>/.test(decoded)) {
+                if (hasBracketedAddress(decoded)) {
                     let parsed = addressparser(decoded);
                     if (parsed.length) {
                         parsed.forEach(entry => {
@@ -852,7 +894,8 @@ class MailParser extends Transform {
     processChunk(data, done) {
         let partId = null;
         if (data._parentBoundary) {
-            partId = this._getPartId(data._parentBoundary);
+            // mailsplit numbers parts IMAP style from the actual tree, TEXT markers are not part of the id
+            partId = (data.partNr || []).filter(nr => typeof nr === 'number').join('.') || null;
         }
         switch (data.type) {
             case 'node': {
@@ -884,6 +927,11 @@ class MailParser extends Transform {
                         contentType = this.libmime.detectMimeType(data.filename) || 'application/octet-stream';
                     }
 
+                    // backpressure state for the attachment stream, see pump() below
+                    let released = false;
+                    let waitingDrain = false;
+                    let pump = null;
+
                     let attachment = {
                         type: 'attachment',
                         content: null,
@@ -891,6 +939,11 @@ class MailParser extends Transform {
                         partId,
                         release: () => {
                             attachment.release = null;
+                            released = true;
+                            if (waitingDrain) {
+                                waitingDrain = false;
+                                pump();
+                            }
                             if (this.waitUntilAttachmentEnd && typeof this.attachmentCallback === 'function') {
                                 setImmediate(this.attachmentCallback);
                             }
@@ -900,16 +953,38 @@ class MailParser extends Transform {
                     };
 
                     let algo = this.options.checksumAlgo || 'md5';
-                    let hasher = new StreamHash(attachment, algo);
+                    let hasher;
+                    try {
+                        hasher = new StreamHash(attachment, algo);
+                    } catch (err) {
+                        // an algorithm this Node does not offer (a typo, or MD5 on a host whose
+                        // OpenSSL runs in FIPS mode) is a parser error, not a process-ending throw
+                        err.message = `Checksum algorithm "${algo}" is not available: ${err.message}`;
+                        return done(err);
+                    }
                     node.decoder.on('error', err => {
                         hasher.emit('error', err);
                     });
 
-                    node.decoder.on('readable', () => {
+                    // Honour the consumer's backpressure while it reads the attachment. Once the
+                    // attachment is released it is drained regardless, so that a caller that
+                    // releases without reading the content does not stall the parser.
+                    pump = () => {
                         let chunk;
-
                         while ((chunk = node.decoder.read()) !== null) {
-                            hasher.write(chunk);
+                            if (hasher.write(chunk) === false && !released) {
+                                waitingDrain = true;
+                                return hasher.once('drain', () => {
+                                    waitingDrain = false;
+                                    pump();
+                                });
+                            }
+                        }
+                    };
+
+                    node.decoder.on('readable', () => {
+                        if (!waitingDrain) {
+                            pump();
                         }
                     });
 
@@ -1041,22 +1116,6 @@ class MailParser extends Transform {
         setImmediate(done);
     }
 
-    _getPartId(parentBoundary) {
-        let boundaryIndex = this.boundaries.findIndex(item => item.name === parentBoundary);
-        if (boundaryIndex === -1) {
-            this.boundaries.push({ name: parentBoundary, count: 1 });
-            boundaryIndex = this.boundaries.length - 1;
-        } else {
-            this.boundaries[boundaryIndex].count++;
-        }
-        let partId = '1';
-        for (let i = 0; i <= boundaryIndex; i++) {
-            if (i === 0) partId = this.boundaries[i].count.toString();
-            else partId += '.' + this.boundaries[i].count.toString();
-        }
-        return partId;
-    }
-
     getAddressesHTML(value) {
         let formatSingleLevel = addresses =>
             addresses
@@ -1139,12 +1198,28 @@ class MailParser extends Transform {
         let pos = 0;
         let processNext = () => {
             if (pos >= cidList.length) {
-                html = html.replace(/\bcid:([^'"\s]{1,256})/g, (match, cid) => {
-                    if (cids.has(cid) && cids.get(cid).url) {
-                        return cids.get(cid).url;
-                    }
-                    return match;
-                });
+                let maxSize = this.options.maxInlinedImagesSize;
+                if (typeof maxSize !== 'number' || !(maxSize >= 0)) {
+                    maxSize = MAX_INLINED_IMAGES_SIZE;
+                }
+                let inlinedSize = 0;
+                try {
+                    html = html.replace(/\bcid:([^'"\s]{1,256})/g, (match, cid) => {
+                        let url = cids.has(cid) && cids.get(cid).url;
+                        if (!url) {
+                            return match;
+                        }
+                        url = String(url);
+                        if (inlinedSize + url.length > maxSize) {
+                            return match;
+                        }
+                        inlinedSize += url.length;
+                        return url;
+                    });
+                } catch (err) {
+                    // runs from setImmediate, a throw here would be an uncaught exception
+                    return done(err);
+                }
 
                 return done(null, html);
             }

package/node_modules/mailparser/lib/simple-parser.js

@@ -19,6 +19,18 @@ module.exports = (input, options, callback) => {
         });
     }
 
+    // MailParser may emit a non-fatal 'error' (eg. HTML too long to convert to text) and
+    // still reach 'end', so settle only once: the first error or the result wins
+    let settled = false;
+    let settle = callback;
+    callback = (...args) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        settle(...args);
+    };
+
     options = options || {};
     let keepCidLinks = !!options.keepCidLinks;
 

package/node_modules/mailparser/lib/stream-hash.js

@@ -8,7 +8,7 @@ class StreamHash extends Transform {
         super();
         this.attachment = attachment;
         this.algo = (algo || 'md5').toLowerCase();
-        this.hash = crypto.createHash(algo);
+        this.hash = crypto.createHash(this.algo);
         this.byteCount = 0;
     }
 

package/node_modules/mailparser/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.28",
+    "version": "3.9.34",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -22,10 +22,10 @@
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
-        "libmime": "5.4.4",
+        "libmime": "5.4.6",
         "linkify-it": "5.0.2",
-        "@zone-eu/mailsplit": "5.4.17",
-        "nodemailer": "10.0.10",
+        "@zone-eu/mailsplit": "5.4.19",
+        "nodemailer": "10.0.14",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
@@ -33,7 +33,7 @@
         "@eslint/eslintrc": "3.3.7",
         "@eslint/js": "10.0.1",
         "ajv": "8.20.0",
-        "eslint": "10.10.0",
+        "eslint": "10.12.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.3",
@@ -41,7 +41,7 @@
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "27.0.0",
         "iconv": "3.0.1",
-        "prettier": "3.9.6",
+        "prettier": "3.9.9",
         "random-message": "1.1.0"
     },
     "repository": {

package/node_modules/nodemailer/CHANGELOG.md

@@ -1,5 +1,43 @@
 # CHANGELOG
 
+## [10.0.14](https://github.com/nodemailer/nodemailer/compare/v10.0.13...v10.0.14) (2026-10-03)
+
+
+### Bug Fixes
+
+* **addressparser:** keep a quoted display name that holds no "@" out of the address ([3570d26](https://github.com/nodemailer/nodemailer/commit/3570d26c7b55f6e5df50d4076046600ad3fd040b))
+* **addressparser:** keep the group recursion depth out of the options object ([a680254](https://github.com/nodemailer/nodemailer/commit/a68025405a1378c82e78f64ffad27b92c1035cbe))
+* **addressparser:** stop a "[" from hiding the operators after it ([5619784](https://github.com/nodemailer/nodemailer/commit/561978491d5cc33d2052a6c89a499b838b960262))
+* **dkim:** trim a header field name in linear time ([c6f7a55](https://github.com/nodemailer/nodemailer/commit/c6f7a55a2978bf031b8519ebf59baddf94c032c8))
+* **mime-funcs:** read and write header parameters per rfc2045 and rfc2231 ([b8ccad7](https://github.com/nodemailer/nodemailer/commit/b8ccad723a7e49a674a4d70f32eb9fe77312008d))
+* search only the new bytes for the end of the proxy CONNECT response ([81efd7b](https://github.com/nodemailer/nodemailer/commit/81efd7bfc559305f900d6a22b5c56aa94556002b))
+
+## [10.0.13](https://github.com/nodemailer/nodemailer/compare/v10.0.12...v10.0.13) (2026-09-30)
+
+
+### Bug Fixes
+
+* read the advertised SASL methods without backtracking regexes ([b5a896f](https://github.com/nodemailer/nodemailer/commit/b5a896fcb02df1628329d7cd665ca08490b14b56))
+* strip comments inside an angle-addr before it becomes the address ([a502247](https://github.com/nodemailer/nodemailer/commit/a502247555fd81773eac337486781f3b6008e16a))
+
+## [10.0.12](https://github.com/nodemailer/nodemailer/compare/v10.0.11...v10.0.12) (2026-09-28)
+
+
+### Bug Fixes
+
+* settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS ([63ccd66](https://github.com/nodemailer/nodemailer/commit/63ccd66c894bbaac18c82084ee385bf6488226cf))
+
+## [10.0.11](https://github.com/nodemailer/nodemailer/compare/v10.0.10...v10.0.11) (2026-09-27)
+
+
+### Bug Fixes
+
+* **fetch:** report a form body that can not be encoded through the returned stream ([74d40bf](https://github.com/nodemailer/nodemailer/commit/74d40bf1e4553bc0568b471250a9251bcb569b00))
+* keep the CommonJS entry point and the services subpath compatible with the pre-TypeScript build ([52901ef](https://github.com/nodemailer/nodemailer/commit/52901ef3725ad179aa56276495a60f53b2c83516))
+* **qp:** keep wrap() terminating for short line lengths and a trailing incomplete escape ([8fa140b](https://github.com/nodemailer/nodemailer/commit/8fa140b11c62cb1202eac84d35bb3ba28bc3b1a1))
+* **smtp-connection:** fail a password login cleanly when the server offers only XOAUTH2 ([90abf7d](https://github.com/nodemailer/nodemailer/commit/90abf7d11db5ebfeb4292b62c1fff969741c7d33))
+* **types:** restore the layout of @types/nodemailer in the bundled declarations ([ac2e40f](https://github.com/nodemailer/nodemailer/commit/ac2e40ffc69427e0eb33ce3945fae76c4c828c8d))
+
 ## [10.0.10](https://github.com/nodemailer/nodemailer/compare/v10.0.9...v10.0.10) (2026-09-14)
 
 

package/node_modules/nodemailer/README.md

@@ -72,7 +72,7 @@ let configOptions = {
 
 #### I have an issue with TypeScript types
 
-Nodemailer 10 and later are written in TypeScript and ship their own type definitions, so `@types/nodemailer` is no longer needed and should be removed from your project to avoid conflicting declarations. The type names follow the layout of the old definitions, so references such as `Mail.Options`, `SMTPTransport.Options` or `Transporter<SMTPTransport.SentMessageInfo>` keep compiling, and the most used types (`SendMailOptions`, `Transporter`, `SentMessageInfo`, `Attachment`, `Address`) are exported from the package root. For older Nodemailer versions, the community maintained [type definitions](https://www.npmjs.com/package/@types/nodemailer) still apply.
+Nodemailer 10 and later are written in TypeScript and ship their own type definitions, so `@types/nodemailer` is no longer needed and should be removed from your project to avoid conflicting declarations. The type names follow the layout of the old definitions, so references such as `Mail.Options`, `SMTPTransport.Options` or `Transporter<SMTPTransport.SentMessageInfo>` keep compiling, and the most used types (`SendMailOptions`, `Transporter`, `SentMessageInfo`, `Attachment`, `Address`) are exported from the package root. The modules under `nodemailer/lib/` are declared with a default export, so import a class as `import SMTPTransport from 'nodemailer/lib/smtp-transport'` (with `esModuleInterop` in a CommonJS project). The `import SMTPTransport = require(...)` and `import * as SMTPTransport from ...` forms still resolve the type aliases such as `SMTPTransport.Options`, but they refer to the module rather than to the class, so the class itself has to be imported with a default import. For older Nodemailer versions, the community maintained [type definitions](https://www.npmjs.com/package/@types/nodemailer) still apply.
 
 #### I have a different problem
 

package/node_modules/nodemailer/dist/cjs/addressparser/index.d.ts

@@ -39,7 +39,21 @@ export type Address = MailboxAddress | GroupAddress;
  *
  * @param str Address field
  * @param options Optional options object
- * @param options._depth Internal recursion depth counter (do not set manually)
  * @return An array of address objects
  */
-export default function addressparser(str?: string | null, options?: AddressParserOptions): Address[];
+declare function addressparser(str: string | null | undefined, options: AddressParserOptions & {
+    flatten: true;
+}): MailboxAddress[];
+declare function addressparser(str?: string | null, options?: AddressParserOptions): Address[];
+/**
+ * Type aliases in the layout of @types/nodemailer, so `addressparser.Address` style references keep working
+ */
+type AddressEntry = Address;
+declare namespace addressparser {
+    type Address = MailboxAddress;
+    type Group = GroupAddress;
+    type AddressOrGroup = AddressEntry;
+}
+/** The names @types/nodemailer used for the group entry and for the union of both entry types */
+export type { GroupAddress as Group, Address as AddressOrGroup };
+export default addressparser;

package/node_modules/nodemailer/dist/cjs/addressparser/index.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = addressparser;
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *
@@ -243,6 +242,81 @@ function _recoverAddrSpec(data) {
         .filter(part => part)
         .join(' ');
 }
+/**
+ * Takes the RFC 5322 comments out of the contents of an angle-addr.
+ *
+ * The tokenizer tracks a single open operator, so once '<' is open a '(' is plain text and
+ * a comment inside the brackets reached the address verbatim: 'Name <user@example.com(x)evil.com>'
+ * put 'user@example.com(x)evil.com' into the envelope, a value that is no mailbox and that a
+ * receiver stripping the comment reads as 'user@example.comevil.com' (GHSA-g73g-hqqh-jr95).
+ * A comment is folding whitespace, so it is read as a space that splits two atoms and as
+ * nothing next to an '@', the same rule the token walk applies outside the brackets. Quoted
+ * strings and domain literals are copied through untouched, a '(' in there is not a comment.
+ *
+ * @param address Contents of the angle brackets
+ * @return The address with the comments removed, and the text of the comments
+ */
+function _stripAddressComments(address) {
+    const comments = [];
+    let result = '';
+    let comment = '';
+    let depth = 0;
+    let closer = '';
+    // carried along rather than read back off the growing result, which would flatten it on
+    // every comment (see lastChars in _handleAddress)
+    let lastChar = '';
+    for (let i = 0, len = address.length; i < len; i++) {
+        const chr = address.charAt(i);
+        if (depth) {
+            if (chr === '\\' && i < len - 1) {
+                comment += address.charAt(++i);
+            }
+            else if (chr === '(') {
+                depth++;
+                comment += chr;
+            }
+            else if (chr === ')' && !--depth) {
+                comments.push(comment.trim());
+                comment = '';
+                if (lastChar !== '@' && address.charAt(i + 1) !== '@') {
+                    result += ' ';
+                    lastChar = ' ';
+                }
+            }
+            else {
+                comment += chr;
+            }
+            continue;
+        }
+        if (closer) {
+            if (chr === '\\' && closer === '"' && i < len - 1) {
+                result += chr + address.charAt(++i);
+                lastChar = address.charAt(i);
+                continue;
+            }
+            if (chr === closer) {
+                closer = '';
+            }
+        }
+        else if (chr === '"') {
+            closer = '"';
+        }
+        else if (chr === '[') {
+            closer = ']';
+        }
+        else if (chr === '(') {
+            depth = 1;
+            continue;
+        }
+        result += chr;
+        lastChar = chr;
+    }
+    if (depth) {
+        // an unterminated comment runs to the end of the address
+        comments.push(comment.trim());
+    }
+    return { address: result.trim(), comments: comments.filter(text => text) };
+}
 /**
  * Converts tokens for a single address into an address object
  *
@@ -354,7 +428,7 @@ function _handleAddress(tokens, depth) {
         // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
         let groupMembers = [];
         if (data.group.length) {
-            const parsedGroup = addressparser(data.group.join(','), { _depth: depth + 1 });
+            const parsedGroup = _parseAddressList(data.group.join(','), depth + 1);
             parsedGroup.forEach(member => {
                 if (member.group) {
                     groupMembers = groupMembers.concat(member.group);
@@ -370,6 +444,24 @@ function _handleAddress(tokens, depth) {
         });
     }
     else {
+        // Comments come out of the angle-addr before anything asks whether one was found, so
+        // that brackets holding nothing but a comment read the same as empty ones
+        const addressComments = [];
+        const addressParts = [];
+        for (const part of data.address) {
+            if (part.indexOf('(') < 0) {
+                addressParts.push(part);
+                continue;
+            }
+            const stripped = _stripAddressComments(part);
+            for (const comment of stripped.comments) {
+                addressComments.push(comment);
+            }
+            if (stripped.address) {
+                addressParts.push(stripped.address);
+            }
+        }
+        data.address = addressParts;
         // If no address was found, try to detect one from regular text
         if (!data.address.length && data.text.length) {
             for (let i = data.text.length - 1; i >= 0; i--) {
@@ -423,7 +515,13 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
-        if (addressFromQuotedText && data.text) {
+        if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
+            // A quoted run with no '@' in it is a display name and nothing else, so it stays
+            // where it is. Moving it over anyway made a comment the mailbox was read from:
+            // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
+            // comment as the name, and a quoted name holding a ',' or a ';' became an address
+            // that reads as two recipients once a consumer writes it back into a header.
+            //
             // The mailbox is still sitting in the text, so it moves over here and is quoted
             // before the recovery below rather than after it. Anything else the text holds
             // came along with it: a comment ends the domain but leaves the atoms behind it in
@@ -436,6 +534,10 @@ function _handleAddress(tokens, depth) {
             data.text = '';
         }
         _recoverAddrSpec(data);
+        // a comment names the mailbox only when nothing else does, as one outside the brackets
+        if (!data.text && addressComments.length) {
+            data.text = addressComments.join(' ');
+        }
         const address = {
             address: data.address || data.text || '',
             name: data.text || data.address || ''
@@ -466,6 +568,7 @@ class Tokenizer {
         this.node = null;
         this.escaped = false;
         this.inDomainLiteral = false;
+        this.afterAt = false;
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -509,17 +612,23 @@ class Tokenizer {
      * Checks if a character is an operator or text and acts accordingly
      *
      * @param chr Character from the address field
+     * @param nextChr Character following chr, null at the end of the field
      */
     checkChar(chr, nextChr) {
-        // Track RFC 5322 domain-literals ("[" *dtext "]"). Operator characters such
-        // as the ":" of an IPv6 address-literal (user@[IPv6:2001:db8::1]) are dtext
-        // and must not be treated as the group delimiter while inside the brackets.
-        // Quoted strings and comments are handled separately via operatorExpecting,
-        // so only enter this state when no operator is open. The list separators ","
-        // and ";" are the exception: they always end the literal (and split the
-        // address list) so that an unclosed "[" cannot swallow later recipients.
+        // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6
+        // address-literal (user@[IPv6:2001:db8::1]) is dtext and must not be treated as
+        // the group delimiter while inside the brackets. That is the only operator the
+        // literal hides: letting it hide the others as well meant a "[" could turn the
+        // comment, quoted string or angle-addr after it into text and pick a different
+        // mailbox, '[ ( ] <a@victim.com> ) <b@evil.com>' yielded a@victim.com where
+        // RFC 5322 reads b@evil.com. A "[" also only opens a literal right after the "@"
+        // of an addr-spec, so the group delimiter of a display name holding one stays
+        // intact. Quoted strings and comments are handled separately via
+        // operatorExpecting, so only enter this state when no operator is open. The list
+        // separators "," and ";" always end the literal (and split the address list) so
+        // that an unclosed "[" cannot swallow later recipients.
         if (!this.escaped && !this.operatorExpecting) {
-            if (!this.inDomainLiteral && chr === '[') {
+            if (!this.inDomainLiteral && chr === '[' && this.afterAt) {
                 this.inDomainLiteral = true;
             }
             else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
@@ -539,17 +648,24 @@ class Tokenizer {
             }
             this.list.push(this.node);
             this.node = null;
+            if (chr !== ')') {
+                // a comment is folding whitespace, it does not part the "@" from the "["
+                this.afterAt = false;
+            }
             this.operatorExpecting = '';
             this.escaped = false;
             return;
         }
-        else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
+        else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
             this.node = {
                 type: 'operator',
                 value: chr
             };
             this.list.push(this.node);
             this.node = null;
+            if (chr !== '(') {
+                this.afterAt = false;
+            }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
             return;
@@ -573,6 +689,11 @@ class Tokenizer {
         if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
             // skip command bytes
             this.node.value += chr;
+            // text inside a quoted string or a comment is not part of an addr-spec. Tracked
+            // as it goes rather than read back off the value (see lastChars in _handleAddress)
+            if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
+                this.afterAt = chr === '@';
+            }
         }
         this.escaped = false;
     }
@@ -584,24 +705,18 @@ class Tokenizer {
  */
 const MAX_NESTED_GROUP_DEPTH = 50;
 /**
- * Parses structured e-mail addresses from an address field
- *
- * Example:
- *
- *    'Name <address@domain>'
+ * Parses an address list, recursing into the groups it holds.
  *
- * will be converted to
- *
- *     [{name: 'Name', address: 'address@domain'}]
+ * The depth is threaded through the calls rather than carried in an options object, so a
+ * caller supplied one can not seed it and lift the recursion limit: `{ _depth: -1e9 }`
+ * bought a billion levels of nesting and turned the guard below into the stack overflow it
+ * is there to prevent.
  *
  * @param str Address field
- * @param options Optional options object
- * @param options._depth Internal recursion depth counter (do not set manually)
+ * @param depth Current recursion depth for nested group protection
  * @return An array of address objects
  */
-function addressparser(str, options) {
-    options = options || {};
-    const depth = options._depth || 0;
+function _parseAddressList(str, depth) {
     // Prevent stack overflow from deeply nested groups (DoS protection)
     if (depth > MAX_NESTED_GROUP_DEPTH) {
         return [];
@@ -610,7 +725,7 @@ function addressparser(str, options) {
     const tokens = tokenizer.tokenize();
     const addresses = [];
     let address = [];
-    let parsedAddresses = [];
+    const parsedAddresses = [];
     tokens.forEach(token => {
         if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
             if (address.length) {
@@ -651,8 +766,11 @@ function addressparser(str, options) {
         }
     }
     mergedAddresses.reverse();
-    parsedAddresses = mergedAddresses;
-    if (options.flatten) {
+    return mergedAddresses;
+}
+function addressparser(str, options) {
+    const parsedAddresses = _parseAddressList(str, 0);
+    if (options?.flatten) {
         const flatAddresses = [];
         const walkAddressList = (list) => {
             list.forEach(entry => {
@@ -667,5 +785,6 @@ function addressparser(str, options) {
     }
     return parsedAddresses;
 }
+exports.default = addressparser;
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });