elit 3.6.9 → 3.7.1

package/dist/smtp-server.js

@@ -12,11 +12,20 @@
     if (typeof require !== "undefined") return require.apply(this, arguments);
     throw Error('Dynamic require of "' + x + '" is not supported');
   });
-  var __esm = (fn, res) => function __init() {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  var __esm = (fn, res, err) => function __init() {
+    if (err) throw err[0];
+    try {
+      return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+    } catch (e) {
+      throw err = [e], e;
+    }
   };
   var __commonJS = (cb, mod) => function __require2() {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    try {
+      return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    } catch (e) {
+      throw mod = 0, e;
+    }
   };
   var __export = (target, all) => {
     for (var name in all)
@@ -77,6 +86,8 @@
           this._maxBytes = maxBytes && Number(maxBytes) || Infinity;
           this.dataBytes = 0;
           this._dataStream = new PassThrough();
+          this._dataStream.byteLength = 0;
+          this._dataStream.sizeExceeded = false;
           return this._dataStream;
         }
         /**
@@ -91,6 +102,21 @@
           }
         }
         // PRIVATE METHODS
+        /**
+         * Counts emitted data bytes and keeps the byteLength/sizeExceeded
+         * properties of the data stream up to date while the message is still
+         * being received, so that applications can detect an oversized message
+         * mid-transfer instead of only after the stream has ended
+         */
+        _countDataBytes(len) {
+          this.dataBytes += len;
+          if (this._dataStream) {
+            this._dataStream.byteLength = this.dataBytes;
+            if (this.dataBytes > this._maxBytes) {
+              this._dataStream.sizeExceeded = true;
+            }
+          }
+        }
         /**
          * Writable._write method.
          */
@@ -169,7 +195,7 @@
               if (Buffer.compare(chunk.slice(i - 2, i + 3), endseq) === 0) {
                 if (i > 2) {
                   buf = chunk.slice(0, i);
-                  this.dataBytes += buf.length;
+                  this._countDataBytes(buf.length);
                   this._endDataMode(buf, chunk.slice(i + 3), done);
                 } else {
                   this._endDataMode(false, chunk.slice(i + 3), done);
@@ -179,7 +205,7 @@
               if (chunk[i + 1] === 46) {
                 buf = chunk.slice(0, i);
                 this._lastBytes = false;
-                this.dataBytes += buf.length;
+                this._countDataBytes(buf.length);
                 if (this._dataStream.writable) {
                   this._dataStream.write(buf);
                 }
@@ -194,7 +220,7 @@
           }
           if (this._lastBytes.length < chunk.length) {
             buf = chunk.slice(0, chunk.length - this._lastBytes.length);
-            this.dataBytes += buf.length;
+            this._countDataBytes(buf.length);
             if (this._dataStream.writable) {
               handled = this._dataStream.write(buf);
               if (!handled) {
@@ -349,6 +375,7 @@
       "use strict";
       var util = __require("util");
       var crypto = __require("crypto");
+      var CONTROL_CHARS = /[\x00-\x1F\x7F-\x9F]/;
       var SASL = module.exports = {
         SASL_PLAIN(args, callback) {
           if (args.length > 1) {
@@ -392,9 +419,9 @@
             return callback();
           }
           let challenge = util.format(
-            "<%s%s@%s>",
-            String(Math.random()).replace(/^[0.]+/, "").substr(0, 8),
-            // random numbers
+            "<%s.%s@%s>",
+            crypto.randomBytes(16).toString("hex"),
+            // random
             Math.floor(Date.now() / 1e3),
             // timestamp
             this.name
@@ -415,12 +442,20 @@
             this.send(500, "Error: invalid userdata");
             return callback();
           }
-          let username = data[1] || data[0] || "";
+          let authzid = data[0] || "";
+          let authcid = data[1] || "";
+          let username = authcid || authzid;
           let password = data[2] || "";
+          if (CONTROL_CHARS.test(username) || CONTROL_CHARS.test(authzid)) {
+            this.send(500, "Error: invalid userdata");
+            return callback();
+          }
           this._server.onAuth(
             {
               method: "PLAIN",
               username,
+              authcid,
+              authzid,
               password
             },
             this.session,
@@ -486,6 +521,10 @@
             this.send(500, "Error: missing username");
             return callback();
           }
+          if (CONTROL_CHARS.test(username)) {
+            this.send(500, "Error: invalid userdata");
+            return callback();
+          }
           this._nextHandler = SASL.LOGIN_password.bind(this, username);
           this.send(334, "UGFzc3dvcmQ6");
           return callback();
@@ -576,7 +615,7 @@
               }
             }
           });
-          if (!username || !accessToken) {
+          if (!username || !accessToken || CONTROL_CHARS.test(username)) {
             this.send(500, "Error: invalid userdata");
             return callback();
           }
@@ -652,6 +691,10 @@
           let tokenParts = Buffer.from(token, "base64").toString().split(" ");
           let username = tokenParts.shift();
           let challengeResponse = (tokenParts.shift() || "").toLowerCase();
+          if (CONTROL_CHARS.test(username)) {
+            this.send(500, "Error: invalid userdata");
+            return callback();
+          }
           this._server.onAuth(
             {
               method: "CRAM-MD5",
@@ -1642,20 +1685,42 @@
             }
             if (typeof value === "string") {
               value = value.replace(/\+([0-9A-F]{2})/g, (match, hex) => unescape("%" + hex));
+              if (/[\x00-\x1F\x7F]/.test(value)) {
+                invalid = true;
+                return;
+              }
             }
             if (!args) {
               args = {};
             }
             args[key] = value;
           });
-          if (address) {
+          if (address && /[\x00-\x1F\x7F-\x9F\u200B\u2060\uFEFF]/.test(address)) {
+            invalid = true;
+          } else if (address) {
             address = address.split("@");
             if (address.length !== 2 || !address[0] || !address[1]) {
               invalid = true;
             } else {
               let localPart = address[0];
               let domain = address[1];
-              if (localPart.length + 1 + domain.length > 253) {
+              if (this._server.options.lenientAddressParsing) {
+                try {
+                  address = [localPart, "@", punycode2.toUnicode(domain)].join("");
+                } catch (E) {
+                  this._server.logger.error(
+                    {
+                      tnx: "punycode",
+                      cid: this.id,
+                      user: this.session.user && this.session.user.username || this.session.user
+                    },
+                    'Failed to process punycode domain "%s". error=%s',
+                    domain,
+                    E.message
+                  );
+                  address = [localPart, "@", domain].join("");
+                }
+              } else if (localPart.length + 1 + domain.length > 253) {
                 invalid = true;
               } else {
                 if (localPart.startsWith(".") || localPart.endsWith(".") || localPart.includes("..")) {
@@ -2167,6 +2232,10 @@
          * Upgrades connection to TLS if possible
          */
         handler_STARTTLS(command, callback) {
+          if (command.toString().trim().split(/\s+/).length > 1) {
+            this.send(501, "Error: syntax: STARTTLS");
+            return callback();
+          }
           if (this.secure) {
             this.send(503, "Error: TLS already active");
             return callback();
@@ -2592,11 +2661,342 @@
     }
   });
 
+  // node_modules/nodemailer/lib/punycode/index.js
+  var require_punycode = __commonJS({
+    "node_modules/nodemailer/lib/punycode/index.js"(exports, module) {
+      "use strict";
+      var maxInt2 = 2147483647;
+      var base2 = 36;
+      var tMin2 = 1;
+      var tMax2 = 26;
+      var skew2 = 38;
+      var damp2 = 700;
+      var initialBias2 = 72;
+      var initialN2 = 128;
+      var delimiter2 = "-";
+      var regexPunycode2 = /^xn--/;
+      var regexNonASCII2 = /[^\0-\x7F]/;
+      var regexSeparators2 = /[\x2E\u3002\uFF0E\uFF61]/g;
+      var errors2 = {
+        overflow: "Overflow: input needs wider integers to process",
+        "not-basic": "Illegal input >= 0x80 (not a basic code point)",
+        "invalid-input": "Invalid input"
+      };
+      var baseMinusTMin2 = base2 - tMin2;
+      var floor2 = Math.floor;
+      var stringFromCharCode2 = String.fromCharCode;
+      function error2(type) {
+        throw new RangeError(errors2[type]);
+      }
+      function map2(array, callback) {
+        const result = [];
+        let length = array.length;
+        while (length--) {
+          result[length] = callback(array[length]);
+        }
+        return result;
+      }
+      function mapDomain2(domain, callback) {
+        const parts = domain.split("@");
+        let result = "";
+        if (parts.length > 1) {
+          result = parts[0] + "@";
+          domain = parts[1];
+        }
+        domain = domain.replace(regexSeparators2, ".");
+        const labels = domain.split(".");
+        const encoded = map2(labels, callback).join(".");
+        return result + encoded;
+      }
+      function ucs2decode2(string) {
+        const output = [];
+        let counter = 0;
+        const length = string.length;
+        while (counter < length) {
+          const value = string.charCodeAt(counter++);
+          if (value >= 55296 && value <= 56319 && counter < length) {
+            const extra = string.charCodeAt(counter++);
+            if ((extra & 64512) == 56320) {
+              output.push(((value & 1023) << 10) + (extra & 1023) + 65536);
+            } else {
+              output.push(value);
+              counter--;
+            }
+          } else {
+            output.push(value);
+          }
+        }
+        return output;
+      }
+      var ucs2encode2 = (codePoints) => String.fromCodePoint(...codePoints);
+      var basicToDigit2 = function(codePoint) {
+        if (codePoint >= 48 && codePoint < 58) {
+          return 26 + (codePoint - 48);
+        }
+        if (codePoint >= 65 && codePoint < 91) {
+          return codePoint - 65;
+        }
+        if (codePoint >= 97 && codePoint < 123) {
+          return codePoint - 97;
+        }
+        return base2;
+      };
+      var digitToBasic2 = function(digit, flag) {
+        return digit + 22 + 75 * (digit < 26) - ((flag != 0) << 5);
+      };
+      var adapt2 = function(delta, numPoints, firstTime) {
+        let k = 0;
+        delta = firstTime ? floor2(delta / damp2) : delta >> 1;
+        delta += floor2(delta / numPoints);
+        for (
+          ;
+          /* no initialization */
+          delta > baseMinusTMin2 * tMax2 >> 1;
+          k += base2
+        ) {
+          delta = floor2(delta / baseMinusTMin2);
+        }
+        return floor2(k + (baseMinusTMin2 + 1) * delta / (delta + skew2));
+      };
+      var decode2 = function(input) {
+        const output = [];
+        const inputLength = input.length;
+        let i = 0;
+        let n = initialN2;
+        let bias = initialBias2;
+        let basic = input.lastIndexOf(delimiter2);
+        if (basic < 0) {
+          basic = 0;
+        }
+        for (let j = 0; j < basic; ++j) {
+          if (input.charCodeAt(j) >= 128) {
+            error2("not-basic");
+          }
+          output.push(input.charCodeAt(j));
+        }
+        for (let index = basic > 0 ? basic + 1 : 0; index < inputLength; ) {
+          const oldi = i;
+          for (let w = 1, k = base2; ; k += base2) {
+            if (index >= inputLength) {
+              error2("invalid-input");
+            }
+            const digit = basicToDigit2(input.charCodeAt(index++));
+            if (digit >= base2) {
+              error2("invalid-input");
+            }
+            if (digit > floor2((maxInt2 - i) / w)) {
+              error2("overflow");
+            }
+            i += digit * w;
+            const t = k <= bias ? tMin2 : k >= bias + tMax2 ? tMax2 : k - bias;
+            if (digit < t) {
+              break;
+            }
+            const baseMinusT = base2 - t;
+            if (w > floor2(maxInt2 / baseMinusT)) {
+              error2("overflow");
+            }
+            w *= baseMinusT;
+          }
+          const out = output.length + 1;
+          bias = adapt2(i - oldi, out, oldi == 0);
+          if (floor2(i / out) > maxInt2 - n) {
+            error2("overflow");
+          }
+          n += floor2(i / out);
+          i %= out;
+          output.splice(i++, 0, n);
+        }
+        return String.fromCodePoint(...output);
+      };
+      var encode2 = function(input) {
+        const output = [];
+        input = ucs2decode2(input);
+        const inputLength = input.length;
+        let n = initialN2;
+        let delta = 0;
+        let bias = initialBias2;
+        for (const currentValue of input) {
+          if (currentValue < 128) {
+            output.push(stringFromCharCode2(currentValue));
+          }
+        }
+        const basicLength = output.length;
+        let handledCPCount = basicLength;
+        if (basicLength) {
+          output.push(delimiter2);
+        }
+        while (handledCPCount < inputLength) {
+          let m = maxInt2;
+          for (const currentValue of input) {
+            if (currentValue >= n && currentValue < m) {
+              m = currentValue;
+            }
+          }
+          const handledCPCountPlusOne = handledCPCount + 1;
+          if (m - n > floor2((maxInt2 - delta) / handledCPCountPlusOne)) {
+            error2("overflow");
+          }
+          delta += (m - n) * handledCPCountPlusOne;
+          n = m;
+          for (const currentValue of input) {
+            if (currentValue < n && ++delta > maxInt2) {
+              error2("overflow");
+            }
+            if (currentValue === n) {
+              let q = delta;
+              for (let k = base2; ; k += base2) {
+                const t = k <= bias ? tMin2 : k >= bias + tMax2 ? tMax2 : k - bias;
+                if (q < t) {
+                  break;
+                }
+                const qMinusT = q - t;
+                const baseMinusT = base2 - t;
+                output.push(stringFromCharCode2(digitToBasic2(t + qMinusT % baseMinusT, 0)));
+                q = floor2(qMinusT / baseMinusT);
+              }
+              output.push(stringFromCharCode2(digitToBasic2(q, 0)));
+              bias = adapt2(delta, handledCPCountPlusOne, handledCPCount === basicLength);
+              delta = 0;
+              ++handledCPCount;
+            }
+          }
+          ++delta;
+          ++n;
+        }
+        return output.join("");
+      };
+      var toUnicode2 = function(input) {
+        return mapDomain2(input, function(string) {
+          return regexPunycode2.test(string) ? decode2(string.slice(4).toLowerCase()) : string;
+        });
+      };
+      var toASCII2 = function(input) {
+        return mapDomain2(input, function(string) {
+          return regexNonASCII2.test(string) ? "xn--" + encode2(string) : string;
+        });
+      };
+      var punycode2 = {
+        /**
+         * A string representing the current Punycode.js version number.
+         * @memberOf punycode
+         * @type String
+         */
+        version: "2.3.1",
+        /**
+         * An object of methods to convert from JavaScript's internal character
+         * representation (UCS-2) to Unicode code points, and back.
+         * @see <https://mathiasbynens.be/notes/javascript-encoding>
+         * @memberOf punycode
+         * @type Object
+         */
+        ucs2: {
+          decode: ucs2decode2,
+          encode: ucs2encode2
+        },
+        decode: decode2,
+        encode: encode2,
+        toASCII: toASCII2,
+        toUnicode: toUnicode2
+      };
+      module.exports = punycode2;
+    }
+  });
+
+  // node_modules/nodemailer/lib/shared/url.js
+  var require_url = __commonJS({
+    "node_modules/nodemailer/lib/shared/url.js"(exports, module) {
+      "use strict";
+      var urllib = __require("url");
+      var punycode2 = require_punycode();
+      var URLImpl = typeof URL !== "undefined" && URL || urllib.URL;
+      var SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)(.+)$/;
+      function safeDecode(str) {
+        try {
+          return decodeURIComponent(str);
+        } catch (_err) {
+          return str;
+        }
+      }
+      function normalizeHostname(raw) {
+        let hostname = raw || "";
+        if (!hostname) {
+          return "";
+        }
+        if (hostname.charAt(0) === "[" && hostname.charAt(hostname.length - 1) === "]") {
+          return hostname.slice(1, -1);
+        }
+        return punycode2.toASCII(safeDecode(hostname));
+      }
+      module.exports.parse = (input, parseQueryString) => {
+        input = input || "";
+        if (!URLImpl) {
+          return urllib.parse(input, parseQueryString);
+        }
+        const slashless = SLASHLESS_AUTHORITY.exec(input);
+        const normalized = slashless ? slashless[1] + "//" + slashless[2] : input;
+        let u;
+        try {
+          u = new URLImpl(normalized);
+        } catch (_err) {
+          return urllib.parse(input, parseQueryString);
+        }
+        const hostname = normalizeHostname(u.hostname);
+        const port = u.port || null;
+        const pathname = u.pathname || null;
+        const search = u.search || null;
+        let auth = null;
+        if (u.username || u.password) {
+          auth = safeDecode(u.username) + (u.password ? ":" + safeDecode(u.password) : "");
+        }
+        let query;
+        if (parseQueryString) {
+          query = /* @__PURE__ */ Object.create(null);
+          u.searchParams.forEach((value, key) => {
+            if (Object.prototype.hasOwnProperty.call(query, key)) {
+              if (Array.isArray(query[key])) {
+                query[key].push(value);
+              } else {
+                query[key] = [query[key], value];
+              }
+            } else {
+              query[key] = value;
+            }
+          });
+        } else {
+          query = search ? search.slice(1) : null;
+        }
+        return {
+          protocol: u.protocol || null,
+          host: u.host || null,
+          hostname,
+          port,
+          pathname,
+          search,
+          path: (pathname || "") + (search || "") || null,
+          href: u.href,
+          auth,
+          query
+        };
+      };
+      module.exports.resolve = (from, to) => {
+        if (!URLImpl) {
+          return urllib.resolve(from, to);
+        }
+        try {
+          return new URLImpl(to, from).href;
+        } catch (_err) {
+          return urllib.resolve(from, to);
+        }
+      };
+    }
+  });
+
   // node_modules/nodemailer/lib/fetch/cookies.js
   var require_cookies = __commonJS({
     "node_modules/nodemailer/lib/fetch/cookies.js"(exports, module) {
       "use strict";
-      var urllib = __require("url");
+      var urllib = require_url();
       var SESSION_TIMEOUT = 1800;
       var Cookies = class {
         constructor(options) {
@@ -2805,7 +3205,7 @@
     "node_modules/nodemailer/package.json"(exports, module) {
       module.exports = {
         name: "nodemailer",
-        version: "8.0.10",
+        version: "9.0.1",
         description: "Easy as cake e-mail sending from your Node.js applications",
         main: "lib/nodemailer.js",
         scripts: {
@@ -2832,19 +3232,19 @@
         },
         homepage: "https://nodemailer.com/",
         devDependencies: {
-          "@aws-sdk/client-sesv2": "3.1037.0",
+          "@aws-sdk/client-sesv2": "3.1068.0",
           bunyan: "1.8.15",
           c8: "11.0.0",
-          eslint: "10.2.1",
+          eslint: "10.5.0",
           "eslint-config-prettier": "10.1.8",
-          globals: "17.5.0",
+          globals: "17.6.0",
           libbase64: "1.3.0",
           libmime: "5.3.8",
           libqp: "2.1.1",
-          prettier: "3.8.3",
+          prettier: "3.8.4",
           proxy: "1.0.2",
           "proxy-test-server": "1.0.0",
-          "smtp-server": "3.18.4"
+          "smtp-server": "3.19.0"
         },
         engines: {
           node: ">=6.0.0"
@@ -2900,7 +3300,7 @@
       "use strict";
       var http = __require("http");
       var https = __require("https");
-      var urllib = __require("url");
+      var urllib = require_url();
       var zlib = __require("zlib");
       var { PassThrough } = __require("stream");
       var Cookies = require_cookies();
@@ -2999,7 +3399,10 @@
           path: parsed.path,
           port: parsed.port ? parsed.port : parsed.protocol === "https:" ? 443 : 80,
           headers,
-          rejectUnauthorized: false,
+          // Validate TLS certificates by default. Callers that genuinely need to
+          // reach a self-signed/internal host opt out explicitly with
+          // options.tls = { rejectUnauthorized: false }.
+          rejectUnauthorized: true,
           agent: false
         };
         if (options.tls) {
@@ -3070,7 +3473,19 @@
             }
             options.method = "GET";
             options.body = false;
-            return nmfetch(urllib.resolve(url, res.headers.location), options);
+            const redirectUrl = urllib.resolve(url, res.headers.location);
+            const redirectParsed = urllib.parse(redirectUrl);
+            const crossHost = redirectParsed.hostname !== parsed.hostname;
+            const downgrade = parsed.protocol === "https:" && redirectParsed.protocol === "http:";
+            if (options.headers && (crossHost || downgrade)) {
+              const sensitive = ["authorization", "cookie", "proxy-authorization"];
+              Object.keys(options.headers).forEach((key) => {
+                if (sensitive.includes(key.toLowerCase())) {
+                  delete options.headers[key];
+                }
+              });
+            }
+            return nmfetch(redirectUrl, options);
           }
           fetchRes.statusCode = res.statusCode;
           fetchRes.headers = res.headers;
@@ -3135,7 +3550,7 @@
   var require_shared = __commonJS({
     "node_modules/nodemailer/lib/shared/index.js"(exports, module) {
       "use strict";
-      var urllib = __require("url");
+      var urllib = require_url();
       var util = __require("util");
       var fs = __require("fs");
       var nmfetch = require_fetch();
@@ -3523,6 +3938,10 @@
             callback = module.exports.callbackPromise(resolve2, reject);
           });
         }
+        resolveContentValue(data, key, options, callback);
+        return promise;
+      };
+      function resolveContentValue(data, key, options, callback) {
         let content = data && data[key] && data[key].content || data[key];
         const encoding = (typeof data[key] === "object" && data[key].encoding || "utf8").toString().toLowerCase().replace(/[-_\s]/g, "");
         if (!content) {
@@ -3549,13 +3968,10 @@
                 callback(err);
               });
             }
-            return resolveStream(nmfetch(content.path || content.href), callback);
+            return resolveStream(nmfetch(content.path || content.href, { headers: content.httpHeaders, tls: content.tls }), callback);
           } else if (/^data:/i.test(content.path || content.href)) {
             const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
-            if (!parsedDataUri || !parsedDataUri.data) {
-              return callback(null, Buffer.from(0));
-            }
-            return callback(null, parsedDataUri.data);
+            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
           } else if (content.path) {
             if (options.disableFileAccess) {
               return setImmediate(() => {
@@ -3571,8 +3987,7 @@
           content = Buffer.from(data[key].content, encoding);
         }
         setImmediate(() => callback(null, content));
-        return promise;
-      };
+      }
       module.exports.assign = function() {
         const args = Array.from(arguments);
         const target = args.shift() || {};
@@ -3687,6 +4102,7 @@
       var punycode2 = (init_punycode_es6(), __toCommonJS(punycode_es6_exports));
       var crypto = __require("crypto");
       var CLOSE_TIMEOUT = 30 * 1e3;
+      var MAX_PROXY_HEADER_LENGTH = 1024;
       var SMTPServer3 = class extends EventEmitter {
         constructor(options) {
           super();
@@ -3720,6 +4136,7 @@
             this.server = net.createServer(this.options, (socket) => {
               this._handleProxy(socket, (err, socketOptions) => {
                 if (err) {
+                  return;
                 }
                 if (this.options.secured) {
                   return this.connect(socket, socketOptions);
@@ -3737,6 +4154,7 @@
               this.options,
               (socket) => this._handleProxy(socket, (err, socketOptions) => {
                 if (err) {
+                  return;
                 }
                 this.connect(socket, socketOptions);
               })
@@ -3961,13 +4379,64 @@
           }
           let chunks = [];
           let chunklen = 0;
-          let socketReader = () => {
+          let finished = false;
+          let onError;
+          let onClose;
+          let onEnd;
+          let socketReader;
+          let cleanup = () => {
+            socket.removeListener("readable", socketReader);
+            socket.removeListener("error", onError);
+            socket.removeListener("close", onClose);
+            socket.removeListener("end", onEnd);
+          };
+          let done = (err, opts) => {
+            if (finished) {
+              return;
+            }
+            finished = true;
+            if (err) {
+              socket.on("error", () => {
+              });
+            }
+            cleanup();
+            callback(err, opts);
+          };
+          onError = (err) => {
+            this.logger.info(
+              {
+                tnx: "proxy",
+                cid: socketOptions.id,
+                err
+              },
+              "[%s] PROXY socket error before header was received: %s",
+              socketOptions.id,
+              err.message
+            );
+            done(err);
+          };
+          onClose = () => {
+            done(new Error("Socket closed before PROXY header was received"));
+          };
+          onEnd = () => {
+            done(new Error("Socket ended before PROXY header was received"));
+          };
+          let rejectInvalid = (message) => {
+            try {
+              socket.end("* BAD Invalid PROXY header\r\n");
+            } catch {
+            }
+            return done(new Error(message || "Invalid PROXY header"));
+          };
+          socketReader = () => {
             let chunk;
             while ((chunk = socket.read()) !== null) {
               for (let i = 0, len = chunk.length; i < len; i++) {
                 let chr = chunk[i];
                 if (chr === 10) {
-                  socket.removeListener("readable", socketReader);
+                  if (chunklen + i + 1 > MAX_PROXY_HEADER_LENGTH) {
+                    return rejectInvalid("PROXY header line too long");
+                  }
                   chunks.push(chunk.slice(0, i + 1));
                   chunklen += i + 1;
                   let remainder = chunk.slice(i + 1);
@@ -3975,14 +4444,10 @@
                     socket.unshift(remainder);
                   }
                   let header = Buffer.concat(chunks, chunklen).toString().trim();
-                  let params = (header || "").toString().split(" ");
+                  let params = header.split(" ");
                   let commandName = params.shift().toUpperCase();
                   if (commandName !== "PROXY") {
-                    try {
-                      socket.end("* BAD Invalid PROXY header\r\n");
-                    } catch {
-                    }
-                    return;
+                    return rejectInvalid();
                   }
                   if (params[1]) {
                     socketOptions.remoteAddress = params[1].trim().toLowerCase();
@@ -3993,31 +4458,36 @@
                           {
                             tnx: "proxy",
                             cid: socketOptions.id,
-                            proxy: params[1].trim().toLowerCase()
+                            proxy: socketOptions.remoteAddress
                           },
                           "[%s] PROXY from %s through %s (%s)",
                           socketOptions.id,
-                          params[1].trim().toLowerCase(),
+                          socketOptions.remoteAddress,
                           params[2].trim().toLowerCase(),
                           JSON.stringify(params)
                         );
                       }
                     } catch {
-                      socket.end("* BAD Invalid PROXY header\r\n");
-                      return;
+                      return rejectInvalid();
                     }
                     if (params[3]) {
                       socketOptions.remotePort = Number(params[3].trim()) || socketOptions.remotePort;
                     }
                   }
-                  return callback(null, socketOptions);
+                  return done(null, socketOptions);
                 }
               }
               chunks.push(chunk);
               chunklen += chunk.length;
+              if (chunklen > MAX_PROXY_HEADER_LENGTH) {
+                return rejectInvalid("PROXY header line too long");
+              }
             }
           };
           socket.on("readable", socketReader);
+          socket.on("error", onError);
+          socket.on("close", onClose);
+          socket.on("end", onEnd);
         }
         /**
          * Called when a new connection is established. This might not be the same time the socket is opened