@nocobase/plugin-workflow-mailer 2.2.16 → 2.2.18

package/dist/node_modules/nodemailer/lib/smtp-connection/index.js

@@ -1,13 +1,13 @@
 'use strict';
 
 const packageInfo = require('../../package.json');
-const EventEmitter = require('events').EventEmitter;
+const { EventEmitter } = require('events');
 const net = require('net');
 const tls = require('tls');
 const os = require('os');
 const crypto = require('crypto');
 const DataStream = require('./data-stream');
-const PassThrough = require('stream').PassThrough;
+const { PassThrough } = require('stream');
 const shared = require('../shared');
 
 // default timeout values in ms
@@ -15,6 +15,29 @@ const CONNECTION_TIMEOUT = 2 * 60 * 1000; // how much to wait for the connection
 const SOCKET_TIMEOUT = 10 * 60 * 1000; // how much to wait for socket inactivity before disconnecting the client
 const GREETING_TIMEOUT = 30 * 1000; // how much to wait after connection is established but SMTP greeting is not receieved
 const DNS_TIMEOUT = 30 * 1000; // how much to wait for resolveHostname
+const TEARDOWN_NOOP = () => {}; // reusable no-op handler for absorbing errors during socket teardown
+
+/**
+ * Re-interpret a server response stored in fake 8-bit byte-container form
+ * (the result of chunk.toString('binary') in _onData) as UTF-8.
+ *
+ * Server reply text has no formally defined charset (RFC 5321 §4.2.1), but
+ * modern MTAs commonly use UTF-8. The byte-container plumbing in _onData is
+ * required to reassemble multi-byte sequences split across socket chunks;
+ * this helper performs the actual decode at the line boundary, falling back
+ * to the byte-container form when the bytes are not valid UTF-8 so that
+ * legacy 8-bit replies are still recoverable byte-for-byte.
+ */
+function decodeServerResponse(str) {
+    if (!str) {
+        return str;
+    }
+    const utf8 = Buffer.from(str, 'binary').toString('utf8');
+    // The input is a byte container (each char is in U+0000..U+00FF) so it can never
+    // already contain U+FFFD; any \uFFFD in the result was inserted by Node's UTF-8
+    // decoder for invalid bytes, which means we should return the original bytes intact.
+    return utf8.includes('\uFFFD') ? str : utf8;
+}
 
 /**
  * Generates a SMTP connection object
@@ -28,9 +51,9 @@ const DNS_TIMEOUT = 30 * 1000; // how much to wait for resolveHostname
  *  * **requireTLS** - forces the client to use STARTTLS
  *  * **name** - the name of the client server
  *  * **localAddress** - outbound address to bind to (see: http://nodejs.org/api/net.html#net_net_connect_options_connectionlistener)
- *  * **greetingTimeout** - Time to wait in ms until greeting message is received from the server (defaults to 10000)
- *  * **connectionTimeout** - how many milliseconds to wait for the connection to establish
- *  * **socketTimeout** - Time of inactivity until the connection is closed (defaults to 1 hour)
+ *  * **greetingTimeout** - Time to wait in ms until greeting message is received from the server (defaults to 30 seconds)
+ *  * **connectionTimeout** - how many milliseconds to wait for the connection to establish (defaults to 2 minutes)
+ *  * **socketTimeout** - Time of inactivity until the connection is closed (defaults to 10 minutes)
  *  * **dnsTimeout** - Time to wait in ms for the DNS requests to be resolved (defaults to 30 seconds)
  *  * **lmtp** - if true, uses LMTP instead of SMTP protocol
  *  * **logger** - bunyan compatible logger interface
@@ -67,7 +90,7 @@ class SMTPConnection extends EventEmitter {
             this.secureConnection = true;
         }
 
-        this.name = this.options.name || this._getHostname();
+        this.name = (this.options.name || this._getHostname()).toString().replace(/[\r\n]+/g, '');
 
         this.logger = shared.getLogger(this.options, {
             component: this.options.component || 'smtp-connection',
@@ -75,13 +98,12 @@ class SMTPConnection extends EventEmitter {
         });
 
         this.customAuth = new Map();
-        Object.keys(this.options.customAuth || {}).forEach(key => {
-            let mapKey = (key || '').toString().trim().toUpperCase();
-            if (!mapKey) {
-                return;
+        for (const key of Object.keys(this.options.customAuth || {})) {
+            const mapKey = (key || '').toString().trim().toUpperCase();
+            if (mapKey) {
+                this.customAuth.set(mapKey, this.options.customAuth[key]);
             }
-            this.customAuth.set(mapKey, this.options.customAuth[key]);
-        });
+        }
 
         /**
          * Expose version nr, just for the reference
@@ -124,7 +146,7 @@ class SMTPConnection extends EventEmitter {
 
         /**
          * The socket connecting to the server
-         * @publick
+         * @public
          */
         this._socket = false;
 
@@ -189,6 +211,13 @@ class SMTPConnection extends EventEmitter {
          */
         this._closing = false;
 
+        /**
+         * Message DATA stream currently piped to the socket, if any. Tracked so
+         * close() can unpipe it before tearing the socket down.
+         * @private
+         */
+        this._currentDataStream = false;
+
         /**
          * Callbacks for socket's listeners
          */
@@ -197,6 +226,17 @@ class SMTPConnection extends EventEmitter {
         this._onSocketClose = () => this._onClose();
         this._onSocketEnd = () => this._onEnd();
         this._onSocketTimeout = () => this._onTimeout();
+
+        /**
+         * Connection-phase error handler (supports fallback to alternative addresses)
+         */
+        this._onConnectionSocketError = err => this._onConnectionError(err, 'ESOCKET');
+
+        /**
+         * Connection attempt counter for fallback race condition protection
+         * @private
+         */
+        this._connectionAttemptId = 0;
     }
 
     /**
@@ -232,17 +272,11 @@ class SMTPConnection extends EventEmitter {
             opts.localAddress = this.options.localAddress;
         }
 
-        let setupConnectionHandlers = () => {
-            this._connectionTimeout = setTimeout(() => {
-                this._onError('Connection timeout', 'ETIMEDOUT', false, 'CONN');
-            }, this.options.connectionTimeout || CONNECTION_TIMEOUT);
-
-            this._socket.on('error', this._onSocketError);
-        };
-
         if (this.options.connection) {
             // connection is already opened
             this._socket = this.options.connection;
+            this._setupConnectionHandlers();
+
             if (this.secureConnection && !this.alreadySecured) {
                 setImmediate(() =>
                     this._upgradeConnection(err => {
@@ -260,115 +294,178 @@ class SMTPConnection extends EventEmitter {
         } else if (this.options.socket) {
             // socket object is set up but not yet connected
             this._socket = this.options.socket;
-            return shared.resolveHostname(opts, (err, resolved) => {
-                if (err) {
-                    return setImmediate(() => this._onError(err, 'EDNS', false, 'CONN'));
-                }
-                this.logger.debug(
-                    {
-                        tnx: 'dns',
-                        source: opts.host,
-                        resolved: resolved.host,
-                        cached: !!resolved.cached
-                    },
-                    'Resolved %s as %s [cache %s]',
-                    opts.host,
-                    resolved.host,
-                    resolved.cached ? 'hit' : 'miss'
-                );
-                Object.keys(resolved).forEach(key => {
-                    if (key.charAt(0) !== '_' && resolved[key]) {
-                        opts[key] = resolved[key];
-                    }
-                });
+            return this._resolveAndConnect(opts, _resolved => {
                 try {
                     this._socket.connect(this.port, this.host, () => {
                         this._socket.setKeepAlive(true);
+
+                        // a `secure` connection over a caller-provided socket must still
+                        // perform the TLS handshake, otherwise AUTH and the message body
+                        // would be sent in cleartext despite the caller requesting TLS
+                        if (this.secureConnection && !this.alreadySecured) {
+                            return this._upgradeConnection(err => {
+                                if (err) {
+                                    this._onError(new Error('Error initiating TLS - ' + (err.message || err)), 'ETLS', false, 'CONN');
+                                    return;
+                                }
+                                this._onConnect();
+                            });
+                        }
+
                         this._onConnect();
                     });
-                    setupConnectionHandlers();
+                    this._setupConnectionHandlers();
                 } catch (E) {
                     return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
                 }
             });
-        } else if (this.secureConnection) {
-            // connect using tls
-            if (this.options.tls) {
-                Object.keys(this.options.tls).forEach(key => {
-                    opts[key] = this.options.tls[key];
-                });
-            }
+        } else {
+            if (this.secureConnection) {
+                Object.assign(opts, this.options.tls || {});
 
-            // ensure servername for SNI
-            if (this.servername && !opts.servername) {
-                opts.servername = this.servername;
+                // ensure servername for SNI
+                if (this.servername && !opts.servername) {
+                    opts.servername = this.servername;
+                }
             }
 
-            return shared.resolveHostname(opts, (err, resolved) => {
-                if (err) {
-                    return setImmediate(() => this._onError(err, 'EDNS', false, 'CONN'));
-                }
-                this.logger.debug(
-                    {
-                        tnx: 'dns',
-                        source: opts.host,
-                        resolved: resolved.host,
-                        cached: !!resolved.cached
-                    },
-                    'Resolved %s as %s [cache %s]',
-                    opts.host,
-                    resolved.host,
-                    resolved.cached ? 'hit' : 'miss'
-                );
-                Object.keys(resolved).forEach(key => {
-                    if (key.charAt(0) !== '_' && resolved[key]) {
-                        opts[key] = resolved[key];
-                    }
-                });
-                try {
-                    this._socket = tls.connect(opts, () => {
-                        this._socket.setKeepAlive(true);
-                        this._onConnect();
-                    });
-                    setupConnectionHandlers();
-                } catch (E) {
-                    return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
-                }
+            return this._resolveAndConnect(opts, resolved => {
+                // Store fallback addresses for retry on connection failure
+                this._fallbackAddresses = (resolved._addresses || []).filter(addr => addr !== opts.host);
+                this._connectOpts = Object.assign({}, opts);
+
+                this._connectToHost(opts, this.secureConnection);
             });
-        } else {
-            // connect using plaintext
-            return shared.resolveHostname(opts, (err, resolved) => {
-                if (err) {
-                    return setImmediate(() => this._onError(err, 'EDNS', false, 'CONN'));
+        }
+    }
+
+    /**
+     * Resolves the hostname and applies resolved values to opts,
+     * then calls the provided callback with the resolved data
+     *
+     * @param {Object} opts Connection options (modified in place)
+     * @param {Function} callback Called with resolved data on success
+     */
+    _resolveAndConnect(opts, callback) {
+        return shared.resolveHostname(opts, (err, resolved) => {
+            if (err) {
+                return setImmediate(() => this._onError(err, 'EDNS', false, 'CONN'));
+            }
+            this.logger.debug(
+                {
+                    tnx: 'dns',
+                    source: opts.host,
+                    resolved: resolved.host,
+                    cached: !!resolved.cached
+                },
+                'Resolved %s as %s [cache %s]',
+                opts.host,
+                resolved.host,
+                resolved.cached ? 'hit' : 'miss'
+            );
+            for (const key of Object.keys(resolved)) {
+                if (key.charAt(0) !== '_' && resolved[key]) {
+                    opts[key] = resolved[key];
                 }
-                this.logger.debug(
-                    {
-                        tnx: 'dns',
-                        source: opts.host,
-                        resolved: resolved.host,
-                        cached: !!resolved.cached
-                    },
-                    'Resolved %s as %s [cache %s]',
-                    opts.host,
-                    resolved.host,
-                    resolved.cached ? 'hit' : 'miss'
-                );
-                Object.keys(resolved).forEach(key => {
-                    if (key.charAt(0) !== '_' && resolved[key]) {
-                        opts[key] = resolved[key];
-                    }
-                });
-                try {
-                    this._socket = net.connect(opts, () => {
-                        this._socket.setKeepAlive(true);
-                        this._onConnect();
-                    });
-                    setupConnectionHandlers();
-                } catch (E) {
-                    return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+            }
+            callback(resolved);
+        });
+    }
+
+    /**
+     * Attempts to connect to the specified host address
+     *
+     * @param {Object} opts Connection options
+     * @param {Boolean} secure Whether to use TLS
+     */
+    _connectToHost(opts, secure) {
+        // If the client was closed while DNS resolution was in flight, do not open
+        // a socket here: close() ran with this._socket still unset and so had
+        // nothing to tear down, and _onConnect's remedial close() is a no-op once
+        // _closing is set — the freshly connected socket would leak.
+        if (this._destroyed || this._closing) {
+            return;
+        }
+
+        this._connectionAttemptId++;
+        const currentAttemptId = this._connectionAttemptId;
+
+        const connectFn = secure ? tls.connect : net.connect;
+        try {
+            this._socket = connectFn(opts, () => {
+                // Ignore callback if this is a stale connection attempt
+                if (this._connectionAttemptId !== currentAttemptId) {
+                    return;
                 }
+                this._socket.setKeepAlive(true);
+                this._onConnect();
             });
+            this._setupConnectionHandlers();
+        } catch (E) {
+            return setImmediate(() => this._onError(E, 'ECONNECTION', false, 'CONN'));
+        }
+    }
+
+    /**
+     * Sets up connection timeout and error handlers
+     */
+    _setupConnectionHandlers() {
+        this._connectionTimeout = setTimeout(() => {
+            this._onConnectionError('Connection timeout', 'ETIMEDOUT');
+        }, this.options.connectionTimeout || CONNECTION_TIMEOUT);
+
+        this._socket.on('error', this._onConnectionSocketError);
+    }
+
+    /**
+     * Handles connection errors with fallback to alternative addresses
+     *
+     * @param {Error|String} err Error object or message
+     * @param {String} code Error code
+     */
+    _onConnectionError(err, code) {
+        clearTimeout(this._connectionTimeout);
+
+        // Check if we have fallback addresses to try
+        const canFallback = this._fallbackAddresses && this._fallbackAddresses.length && this.stage === 'init' && !this._destroyed;
+
+        if (!canFallback) {
+            // No more fallback addresses, report the error
+            this._onError(err, code, false, 'CONN');
+            return;
+        }
+
+        const nextHost = this._fallbackAddresses.shift();
+
+        this.logger.info(
+            {
+                tnx: 'network',
+                failedHost: this._connectOpts.host,
+                nextHost,
+                error: err.message || err
+            },
+            'Connection to %s failed, trying %s',
+            this._connectOpts.host,
+            nextHost
+        );
+
+        // Clean up current socket
+        if (this._socket) {
+            try {
+                this._socket.removeListener('error', this._onConnectionSocketError);
+                // Absorb any late teardown error (e.g. a TLS fallback socket emitting
+                // after destroy), mirroring the guard used in close()
+                this._socket.on('error', TEARDOWN_NOOP);
+                this._socket.destroy();
+            } catch (_E) {
+                // ignore
+            }
+            this._socket = null;
         }
+
+        // Update host and retry
+        this._connectOpts.host = nextHost;
+        this._connectToHost(this._connectOpts, this.secureConnection);
     }
 
     /**
@@ -393,12 +490,7 @@ class SMTPConnection extends EventEmitter {
         }
         this._closing = true;
 
-        let closeMethod = 'end';
-
-        if (this.stage === 'init') {
-            // Close the socket immediately when connection timed out
-            closeMethod = 'destroy';
-        }
+        const closeMethod = this.stage === 'init' ? 'destroy' : 'end';
 
         this.logger.debug(
             {
@@ -408,12 +500,35 @@ class SMTPConnection extends EventEmitter {
             closeMethod
         );
 
-        let socket = (this._socket && this._socket.socket) || this._socket;
+        const socket = (this._socket && this._socket.socket) || this._socket;
+
+        // Detach any in-flight DATA stream from the socket so the source stream
+        // can be garbage-collected once the socket is gone.
+        if (this._currentDataStream) {
+            try {
+                this._currentDataStream.unpipe(this._socket);
+            } catch (_E) {
+                // ignore
+            }
+            this._currentDataStream = false;
+        }
 
         if (socket && !socket.destroyed) {
             try {
-                this._socket[closeMethod]();
-            } catch (E) {
+                // Clear socket timeout to prevent timer leaks
+                socket.setTimeout(0);
+                // Remove all listeners to allow proper garbage collection
+                socket.removeListener('data', this._onSocketData);
+                socket.removeListener('timeout', this._onSocketTimeout);
+                socket.removeListener('close', this._onSocketClose);
+                socket.removeListener('end', this._onSocketEnd);
+                socket.removeListener('error', this._onSocketError);
+                socket.removeListener('error', this._onConnectionSocketError);
+                // Absorb errors that may fire during socket teardown (e.g. server
+                // sending cleartext after TLS shutdown triggers ERR_SSL_BAD_RECORD_TYPE)
+                socket.on('error', TEARDOWN_NOOP);
+                socket[closeMethod]();
+            } catch (_E) {
                 // just ignore
             }
         }
@@ -454,11 +569,11 @@ class SMTPConnection extends EventEmitter {
         }
 
         if (this.customAuth.has(this._authMethod)) {
-            let handler = this.customAuth.get(this._authMethod);
+            const handler = this.customAuth.get(this._authMethod);
             let lastResponse;
             let returned = false;
 
-            let resolve = () => {
+            const resolve = () => {
                 if (returned) {
                     return;
                 }
@@ -477,7 +592,7 @@ class SMTPConnection extends EventEmitter {
                 callback(null, true);
             };
 
-            let reject = err => {
+            const reject = err => {
                 if (returned) {
                     return;
                 }
@@ -485,7 +600,7 @@ class SMTPConnection extends EventEmitter {
                 callback(this._formatError(err, 'EAUTH', lastResponse, 'AUTH ' + this._authMethod));
             };
 
-            let handlerResponse = handler({
+            const handlerResponse = handler({
                 auth: this._auth,
                 method: this._authMethod,
 
@@ -612,7 +727,7 @@ class SMTPConnection extends EventEmitter {
 
         // ensure that callback is only called once
         let returned = false;
-        let callback = function () {
+        const callback = function () {
             if (returned) {
                 return;
             }
@@ -625,13 +740,22 @@ class SMTPConnection extends EventEmitter {
             message.on('error', err => callback(this._formatError(err, 'ESTREAM', false, 'API')));
         }
 
-        let startTime = Date.now();
+        const startTime = Date.now();
         this._setEnvelope(envelope, (err, info) => {
             if (err) {
+                // create passthrough stream to consume to prevent OOM
+                const stream = new PassThrough();
+                if (typeof message.pipe === 'function') {
+                    message.pipe(stream);
+                } else {
+                    stream.write(message);
+                    stream.end();
+                }
+
                 return callback(err);
             }
-            let envelopeTime = Date.now();
-            let stream = this._createSendStream((err, str) => {
+            const envelopeTime = Date.now();
+            const stream = this._createSendStream((err, str) => {
                 if (err) {
                     return callback(err);
                 }
@@ -658,6 +782,11 @@ class SMTPConnection extends EventEmitter {
      * @param {Function} callback Callback to return once connection is reset
      */
     reset(callback) {
+        const isDestroyedMessage = this._isDestroyedMessage('reset');
+        if (isDestroyedMessage) {
+            return callback(this._formatError(isDestroyedMessage, 'ECONNECTION', false, 'API'));
+        }
+
         this._sendCommand('RSET');
         this._responseActions.push(str => {
             if (str.charAt(0) !== '2') {
@@ -704,7 +833,13 @@ class SMTPConnection extends EventEmitter {
         this._socket.removeListener('timeout', this._onSocketTimeout);
         this._socket.removeListener('close', this._onSocketClose);
         this._socket.removeListener('end', this._onSocketEnd);
+        // Switch from connection-phase error handler to normal error handler
+        this._socket.removeListener('error', this._onConnectionSocketError);
+        // _upgradeConnection (options.connection + secure) may already have attached
+        // the normal handler; remove it first so we never end up with a duplicate
+        this._socket.removeListener('error', this._onSocketError);
 
+        this._socket.on('error', this._onSocketError);
         this._socket.on('data', this._onSocketData);
         this._socket.once('close', this._onSocketClose);
         this._socket.once('end', this._onSocketEnd);
@@ -736,7 +871,7 @@ class SMTPConnection extends EventEmitter {
             return;
         }
 
-        let data = (chunk || '').toString('binary');
+        let data = chunk.toString('binary');
         let lines = (this._remainder + data).split(/\r?\n/);
         let lastline;
 
@@ -783,7 +918,12 @@ class SMTPConnection extends EventEmitter {
 
         err = this._formatError(err, type, data, command);
 
-        this.logger.error(data, err.message);
+        const transientCodes = ['ETIMEDOUT', 'ESOCKET', 'ECONNECTION'];
+        if (transientCodes.includes(err.code)) {
+            this.logger.warn(data, err.message);
+        } else {
+            this.logger.error(data, err.message);
+        }
 
         this.emit('error', err);
         this.close();
@@ -807,7 +947,7 @@ class SMTPConnection extends EventEmitter {
             err.message += ': ' + response;
         }
 
-        let responseCode = (typeof response === 'string' && Number((response.match(/^\d+/) || [])[0])) || false;
+        const responseCode = (typeof response === 'string' && Number((response.match(/^\d+/) || [])[0])) || false;
         if (responseCode) {
             err.responseCode = responseCode;
         }
@@ -828,15 +968,15 @@ class SMTPConnection extends EventEmitter {
         let serverResponse = false;
 
         if (this._remainder && this._remainder.trim()) {
+            this.lastServerResponse = serverResponse = decodeServerResponse(this._remainder.trim());
             if (this.options.debug || this.options.transactionLog) {
                 this.logger.debug(
                     {
                         tnx: 'server'
                     },
-                    this._remainder.replace(/\r?\n$/, '')
+                    serverResponse
                 );
             }
-            this.lastServerResponse = serverResponse = this._remainder.trim();
         }
 
         this.logger.info(
@@ -864,7 +1004,9 @@ class SMTPConnection extends EventEmitter {
      */
     _onEnd() {
         if (this._socket && !this._socket.destroyed) {
-            this._socket.destroy();
+            // Peer sent FIN — finish our half of the close gracefully rather
+            // than destroying. 'close' fires after the OS finalizes teardown.
+            this._socket.end();
         }
     }
 
@@ -885,6 +1027,8 @@ class SMTPConnection extends EventEmitter {
             return;
         }
         this._destroyed = true;
+        // keep the documented public flag in sync with the private state
+        this.destroyed = true;
         this.emit('end');
     }
 
@@ -895,6 +1039,15 @@ class SMTPConnection extends EventEmitter {
      *        has been secured
      */
     _upgradeConnection(callback) {
+        // RFC 3207 section 6: the client MUST discard any knowledge obtained from
+        // the server that was not received over the TLS-protected session. Drop any
+        // buffered input received before the handshake so a man-in-the-middle cannot
+        // inject plaintext bytes after the "220" reply (e.g. a CRLF-free fragment that
+        // would otherwise be prepended to the first post-TLS response and parsed as
+        // part of the secured EHLO capabilities). STARTTLS response injection.
+        this._remainder = '';
+        this._responseQueue = [];
+
         // do not remove all listeners or it breaks node v0.10 as there's
         // apparently a 'finish' event set that would be cleared as well
 
@@ -902,21 +1055,32 @@ class SMTPConnection extends EventEmitter {
         this._socket.removeListener('data', this._onSocketData); // incoming data is going to be gibberish from this point onwards
         this._socket.removeListener('timeout', this._onSocketTimeout); // timeout will be re-set for the new socket object
 
-        let socketPlain = this._socket;
-        let opts = {
-            socket: this._socket,
-            host: this.host
-        };
-
-        Object.keys(this.options.tls || {}).forEach(key => {
-            opts[key] = this.options.tls[key];
-        });
+        const socketPlain = this._socket;
+        const opts = Object.assign(
+            {
+                socket: this._socket,
+                host: this.host
+            },
+            this.options.tls || {}
+        );
 
         // ensure servername for SNI
         if (this.servername && !opts.servername) {
             opts.servername = this.servername;
         }
 
+        // Remove all listeners from the plain socket to allow proper garbage
+        // collection. Used on both the TLS-success path and the synchronous
+        // tls.connect() throw path; either way the plain socket is done.
+        const removePlainSocketListeners = () => {
+            socketPlain.removeListener('close', this._onSocketClose);
+            socketPlain.removeListener('end', this._onSocketEnd);
+            socketPlain.removeListener('error', this._onSocketError);
+            // the connection-phase handler is attached when upgrading a pre-opened
+            // options.connection socket; strip it so nothing lingers on the plain socket
+            socketPlain.removeListener('error', this._onConnectionSocketError);
+        };
+
         this.upgrading = true;
         // tls.connect is not an asynchronous function however it may still throw errors and requires to be wrapped with try/catch
         try {
@@ -925,12 +1089,12 @@ class SMTPConnection extends EventEmitter {
                 this.upgrading = false;
                 this._socket.on('data', this._onSocketData);
 
-                socketPlain.removeListener('close', this._onSocketClose);
-                socketPlain.removeListener('end', this._onSocketEnd);
+                removePlainSocketListeners();
 
                 return callback(null, true);
             });
         } catch (err) {
+            removePlainSocketListeners();
             return callback(err);
         }
 
@@ -947,18 +1111,27 @@ class SMTPConnection extends EventEmitter {
 
     /**
      * Processes queued responses from the server
-     *
-     * @param {Boolean} force If true, ignores _processing flag
      */
     _processResponse() {
         if (!this._responseQueue.length) {
             return false;
         }
 
-        let str = (this.lastServerResponse = (this._responseQueue.shift() || '').toString());
+        const raw = (this._responseQueue.shift() || '').toString();
+
+        // Skip unexpected empty lines without consuming a response action or
+        // overwriting lastServerResponse; reprocess whatever else is queued.
+        if (!raw.trim()) {
+            setImmediate(() => this._processResponse());
+            return;
+        }
+
+        let str = (this.lastServerResponse = decodeServerResponse(raw));
 
         if (/^\d+-/.test(str.split('\n').pop())) {
-            // keep waiting for the final part of multiline response
+            // last line is still a continuation: put the partial response back on the
+            // queue and wait for the rest rather than dropping it
+            this._responseQueue.unshift(raw);
             return;
         }
 
@@ -971,12 +1144,7 @@ class SMTPConnection extends EventEmitter {
             );
         }
 
-        if (!str.trim()) {
-            // skip unexpected empty lines
-            setImmediate(() => this._processResponse());
-        }
-
-        let action = this._responseActions.shift();
+        const action = this._responseActions.shift();
 
         if (typeof action === 'function') {
             action.call(this, str);
@@ -1024,7 +1192,7 @@ class SMTPConnection extends EventEmitter {
      *        {from:{address:'...',name:'...'}, to:[address:'...',name:'...']}
      */
     _setEnvelope(envelope, callback) {
-        let args = [];
+        const args = [];
         let useSmtpUtf8 = false;
 
         this._envelope = envelope || {};
@@ -1059,7 +1227,7 @@ class SMTPConnection extends EventEmitter {
         }
 
         // clone the recipients array for latter manipulation
-        this._envelope.rcptQueue = JSON.parse(JSON.stringify(this._envelope.to || []));
+        this._envelope.rcptQueue = [].concat(this._envelope.to || []);
         this._envelope.rejected = [];
         this._envelope.rejectedErrors = [];
         this._envelope.accepted = [];
@@ -1072,6 +1240,23 @@ class SMTPConnection extends EventEmitter {
             }
         }
 
+        // RFC 8689: validate REQUIRETLS eligibility before queuing the MAIL FROM
+        // response action, so a rejection here cannot leave an orphaned action in
+        // _responseActions (which would consume the next reply and desync a reused
+        // connection).
+        if (this._envelope.requireTLSExtensionEnabled) {
+            if (!this.secure) {
+                return callback(
+                    this._formatError('REQUIRETLS can only be used over TLS connections (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM')
+                );
+            }
+            if (!this._supportedExtensions.includes('REQUIRETLS')) {
+                return callback(
+                    this._formatError('Server does not support REQUIRETLS extension (RFC 8689)', 'EREQUIRETLS', false, 'MAIL FROM')
+                );
+            }
+        }
+
         this._responseActions.push(str => {
             this._actionMAIL(str, callback);
         });
@@ -1091,7 +1276,10 @@ class SMTPConnection extends EventEmitter {
         }
 
         if (this._envelope.size && this._supportedExtensions.includes('SIZE')) {
-            args.push('SIZE=' + this._envelope.size);
+            const sizeValue = Number(this._envelope.size) || 0;
+            if (sizeValue > 0) {
+                args.push('SIZE=' + sizeValue);
+            }
         }
 
         // If the server supports DSN and the envelope includes an DSN prop
@@ -1105,6 +1293,13 @@ class SMTPConnection extends EventEmitter {
             }
         }
 
+        // RFC 8689: append the REQUIRETLS keyword to MAIL FROM. Eligibility
+        // (TLS connection + server support) was already validated above, before
+        // the response action was queued.
+        if (this._envelope.requireTLSExtensionEnabled) {
+            args.push('REQUIRETLS');
+        }
+
         this._sendCommand('MAIL FROM:<' + this._envelope.from + '>' + (args.length ? ' ' + args.join(' ') : ''));
     }
 
@@ -1127,7 +1322,7 @@ class SMTPConnection extends EventEmitter {
             throw new Error('ret: ' + JSON.stringify(ret));
         }
 
-        let envid = (params.envid || params.id || '').toString() || null;
+        const envid = (params.envid || params.id || '').toString() || null;
 
         let notify = params.notify || null;
         if (notify) {
@@ -1135,9 +1330,9 @@ class SMTPConnection extends EventEmitter {
                 notify = notify.split(',');
             }
             notify = notify.map(n => n.trim().toUpperCase());
-            let validNotify = ['NEVER', 'SUCCESS', 'FAILURE', 'DELAY'];
-            let invaliNotify = notify.filter(n => !validNotify.includes(n));
-            if (invaliNotify.length || (notify.length > 1 && notify.includes('NEVER'))) {
+            const validNotify = ['NEVER', 'SUCCESS', 'FAILURE', 'DELAY'];
+            const invalidNotify = notify.filter(n => !validNotify.includes(n));
+            if (invalidNotify.length || (notify.length > 1 && notify.includes('NEVER'))) {
                 throw new Error('notify: ' + JSON.stringify(notify.join(',')));
             }
             notify = notify.join(',');
@@ -1157,7 +1352,7 @@ class SMTPConnection extends EventEmitter {
     }
 
     _getDsnRcptToArgs() {
-        let args = [];
+        const args = [];
         // If the server supports DSN and the envelope includes an DSN prop
         // then append DSN params to the RCPT TO command
         if (this._envelope.dsn && this._supportedExtensions.includes('DSN')) {
@@ -1172,12 +1367,11 @@ class SMTPConnection extends EventEmitter {
     }
 
     _createSendStream(callback) {
-        let dataStream = new DataStream();
-        let logStream;
+        const dataStream = new DataStream();
 
         if (this.options.lmtp) {
             this._envelope.accepted.forEach((recipient, i) => {
-                let final = i === this._envelope.accepted.length - 1;
+                const final = i === this._envelope.accepted.length - 1;
                 this._responseActions.push(str => {
                     this._actionLMTPStream(recipient, final, str, callback);
                 });
@@ -1188,12 +1382,13 @@ class SMTPConnection extends EventEmitter {
             });
         }
 
+        this._currentDataStream = dataStream;
         dataStream.pipe(this._socket, {
             end: false
         });
 
         if (this.options.debug) {
-            logStream = new PassThrough();
+            const logStream = new PassThrough();
             logStream.on('readable', () => {
                 let chunk;
                 while ((chunk = logStream.read())) {
@@ -1209,6 +1404,9 @@ class SMTPConnection extends EventEmitter {
         }
 
         dataStream.once('end', () => {
+            if (this._currentDataStream === dataStream) {
+                this._currentDataStream = false;
+            }
             this.logger.info(
                 {
                     tnx: 'message',
@@ -1283,7 +1481,12 @@ class SMTPConnection extends EventEmitter {
 
         if (str.charAt(0) !== '2') {
             if (this.options.requireTLS) {
-                this._onError(new Error('EHLO failed but HELO does not support required STARTTLS. response=' + str), 'ECONNECTION', str, 'EHLO');
+                this._onError(
+                    new Error('EHLO failed but HELO does not support required STARTTLS. response=' + str),
+                    'ECONNECTION',
+                    str,
+                    'EHLO'
+                );
                 return;
             }
 
@@ -1321,6 +1524,11 @@ class SMTPConnection extends EventEmitter {
             this._supportedExtensions.push('8BITMIME');
         }
 
+        // Detect if the server supports REQUIRETLS (RFC 8689)
+        if (/[ -]REQUIRETLS\b/im.test(str)) {
+            this._supportedExtensions.push('REQUIRETLS');
+        }
+
         // Detect if the server supports PIPELINING
         if (/[ -]PIPELINING\b/im.test(str)) {
             this._supportedExtensions.push('PIPELINING');
@@ -1461,22 +1669,21 @@ class SMTPConnection extends EventEmitter {
      * @param {String} str Message from the server
      */
     _actionAUTH_CRAM_MD5(str, callback) {
-        let challengeMatch = str.match(/^334\s+(.+)$/);
-        let challengeString = '';
+        const challengeMatch = str.match(/^334\s+(.+)$/);
 
         if (!challengeMatch) {
-            return callback(this._formatError('Invalid login sequence while waiting for server challenge string', 'EAUTH', str, 'AUTH CRAM-MD5'));
-        } else {
-            challengeString = challengeMatch[1];
+            return callback(
+                this._formatError('Invalid login sequence while waiting for server challenge string', 'EAUTH', str, 'AUTH CRAM-MD5')
+            );
         }
 
         // Decode from base64
-        let base64decoded = Buffer.from(challengeString, 'base64').toString('ascii'),
-            hmacMD5 = crypto.createHmac('md5', this._auth.credentials.pass);
+        const base64decoded = Buffer.from(challengeMatch[1], 'base64').toString('ascii');
+        const hmacMD5 = crypto.createHmac('md5', this._auth.credentials.pass);
 
         hmacMD5.update(base64decoded);
 
-        let prepended = this._auth.credentials.user + ' ' + hmacMD5.digest('hex');
+        const prepended = this._auth.credentials.user + ' ' + hmacMD5.digest('hex');
 
         this._responseActions.push(str => {
             this._actionAUTH_CRAM_MD5_PASS(str, callback);
@@ -1597,39 +1804,29 @@ class SMTPConnection extends EventEmitter {
      * @param {String} str Message from the server
      */
     _actionMAIL(str, callback) {
-        let message, curRecipient;
         if (Number(str.charAt(0)) !== 2) {
-            if (this._usingSmtpUtf8 && /^550 /.test(str) && /[\x80-\uFFFF]/.test(this._envelope.from)) {
-                message = 'Internationalized mailbox name not allowed';
-            } else {
-                message = 'Mail command failed';
-            }
+            const message =
+                this._usingSmtpUtf8 && /^550 /.test(str) && /[\x80-\uFFFF]/.test(this._envelope.from)
+                    ? 'Internationalized mailbox name not allowed'
+                    : 'Mail command failed';
             return callback(this._formatError(message, 'EENVELOPE', str, 'MAIL FROM'));
         }
 
         if (!this._envelope.rcptQueue.length) {
-            return callback(this._formatError('Can\x27t send mail - no recipients defined', 'EENVELOPE', false, 'API'));
-        } else {
-            this._recipientQueue = [];
-
-            if (this._supportedExtensions.includes('PIPELINING')) {
-                while (this._envelope.rcptQueue.length) {
-                    curRecipient = this._envelope.rcptQueue.shift();
-                    this._recipientQueue.push(curRecipient);
-                    this._responseActions.push(str => {
-                        this._actionRCPT(str, callback);
-                    });
-                    this._sendCommand('RCPT TO:<' + curRecipient + '>' + this._getDsnRcptToArgs());
-                }
-            } else {
-                curRecipient = this._envelope.rcptQueue.shift();
-                this._recipientQueue.push(curRecipient);
-                this._responseActions.push(str => {
-                    this._actionRCPT(str, callback);
-                });
-                this._sendCommand('RCPT TO:<' + curRecipient + '>' + this._getDsnRcptToArgs());
-            }
+            return callback(this._formatError("Can't send mail - no recipients defined", 'EENVELOPE', false, 'API'));
         }
+
+        this._recipientQueue = [];
+        const usePipelining = this._supportedExtensions.includes('PIPELINING');
+
+        do {
+            const curRecipient = this._envelope.rcptQueue.shift();
+            this._recipientQueue.push(curRecipient);
+            this._responseActions.push(str => {
+                this._actionRCPT(str, callback);
+            });
+            this._sendCommand('RCPT TO:<' + curRecipient + '>' + this._getDsnRcptToArgs());
+        } while (usePipelining && this._envelope.rcptQueue.length);
     }
 
     /**
@@ -1638,16 +1835,14 @@ class SMTPConnection extends EventEmitter {
      * @param {String} str Message from the server
      */
     _actionRCPT(str, callback) {
-        let message,
-            err,
-            curRecipient = this._recipientQueue.shift();
+        let err;
+        const curRecipient = this._recipientQueue.shift();
         if (Number(str.charAt(0)) !== 2) {
             // this is a soft error
-            if (this._usingSmtpUtf8 && /^553 /.test(str) && /[\x80-\uFFFF]/.test(curRecipient)) {
-                message = 'Internationalized mailbox name not allowed';
-            } else {
-                message = 'Recipient command failed';
-            }
+            const message =
+                this._usingSmtpUtf8 && /^553 /.test(str) && /[\x80-\uFFFF]/.test(curRecipient)
+                    ? 'Internationalized mailbox name not allowed'
+                    : 'Recipient command failed';
             this._envelope.rejected.push(curRecipient);
             // store error for the failed recipient
             err = this._formatError(message, 'EENVELOPE', str, 'RCPT TO');
@@ -1664,18 +1859,18 @@ class SMTPConnection extends EventEmitter {
                 });
                 this._sendCommand('DATA');
             } else {
-                err = this._formatError('Can\x27t send mail - all recipients were rejected', 'EENVELOPE', str, 'RCPT TO');
+                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', str, 'RCPT TO');
                 err.rejected = this._envelope.rejected;
                 err.rejectedErrors = this._envelope.rejectedErrors;
                 return callback(err);
             }
         } else if (this._envelope.rcptQueue.length) {
-            curRecipient = this._envelope.rcptQueue.shift();
-            this._recipientQueue.push(curRecipient);
+            const nextRecipient = this._envelope.rcptQueue.shift();
+            this._recipientQueue.push(nextRecipient);
             this._responseActions.push(str => {
                 this._actionRCPT(str, callback);
             });
-            this._sendCommand('RCPT TO:<' + curRecipient + '>' + this._getDsnRcptToArgs());
+            this._sendCommand('RCPT TO:<' + nextRecipient + '>' + this._getDsnRcptToArgs());
         }
     }
 
@@ -1691,7 +1886,7 @@ class SMTPConnection extends EventEmitter {
             return callback(this._formatError('Data command failed', 'EENVELOPE', str, 'DATA'));
         }
 
-        let response = {
+        const response = {
             accepted: this._envelope.accepted,
             rejected: this._envelope.rejected
         };
@@ -1715,12 +1910,9 @@ class SMTPConnection extends EventEmitter {
      */
     _actionSMTPStream(str, callback) {
         if (Number(str.charAt(0)) !== 2) {
-            // Message failed
             return callback(this._formatError('Message failed', 'EMESSAGE', str, 'DATA'));
-        } else {
-            // Message sent succesfully
-            return callback(null, str);
         }
+        return callback(null, str);
     }
 
     /**
@@ -1803,7 +1995,7 @@ class SMTPConnection extends EventEmitter {
         let defaultHostname;
         try {
             defaultHostname = os.hostname() || '';
-        } catch (err) {
+        } catch (_err) {
             // fails on windows 7
             defaultHostname = 'localhost';
         }