imapflow 1.3.3 → 1.3.5

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.3.3"
+    ".": "1.3.5"
 }

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [1.3.5](https://github.com/postalsys/imapflow/compare/v1.3.4...v1.3.5) (2026-06-01)
+
+
+### Bug Fixes
+
+* correct flag removal, literal parsing, path normalization, and harden the parser ([d15c053](https://github.com/postalsys/imapflow/commit/d15c0536f4b7db2ebca5e258fc885da0d194b5fd))
+* prevent host process crash from socket errors after unbind() when COMPRESS=DEFLATE is active ([e30fca1](https://github.com/postalsys/imapflow/commit/e30fca1a42a4d2ab6f7a6a766effafe3df6b1aff))
+
+## [1.3.4](https://github.com/postalsys/imapflow/compare/v1.3.3...v1.3.4) (2026-05-29)
+
+
+### Bug Fixes
+
+* bumped deps ([593b805](https://github.com/postalsys/imapflow/commit/593b805ed88d62bf7200a1a2ef081ce49f9162c0))
+* handle THREADID NIL in FETCH response ([#353](https://github.com/postalsys/imapflow/issues/353)) ([40318d6](https://github.com/postalsys/imapflow/commit/40318d69b866989d6e84f1d0652d118920a3162e))
+
 ## [1.3.3](https://github.com/postalsys/imapflow/compare/v1.3.2...v1.3.3) (2026-04-29)
 
 

package/SECURITY.md

@@ -0,0 +1,88 @@
+# Security Policy
+
+ImapFlow is a Node.js IMAP client library. It opens TLS/cleartext connections to
+IMAP servers, sends account credentials, and parses untrusted protocol responses
+from those servers. Because it handles credentials and processes data from
+remote servers that may be malicious or buggy, we take security reports
+seriously and aim to respond quickly.
+
+## Supported Versions
+
+Security fixes are released only against the latest version. We do not backport
+patches to older releases - upgrading to the current release line is the
+supported way to receive security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+If you are on an older version, please upgrade. See the release notes at
+<https://github.com/postalsys/imapflow/releases> before updating.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.**
+
+Report privately through one of the following channels:
+
+1. **GitHub Security Advisories (preferred).** Open a private report at
+   <https://github.com/postalsys/imapflow/security/advisories/new>. This keeps
+   the discussion private until a fix is published and lets us credit you.
+2. **Email.** Send details to **andris@postalsys.com** (the contact listed in
+   [`SECURITY.txt`](SECURITY.txt)). Encrypt sensitive details with the PGP key
+   referenced there if possible.
+
+When reporting, please include as much of the following as you can:
+
+- The affected version(s) and environment (ImapFlow version, Node.js version,
+  OS).
+- The component involved (e.g. the IMAP response stream/parser, literal and line
+  handling, TLS/STARTTLS upgrade, credential handling, the command compiler, or
+  the public client API).
+- A clear description of the issue and its impact (e.g. memory exhaustion or
+  denial of service from a malicious server, parser crash, credential
+  disclosure, TLS verification bypass, injection into the IMAP command stream,
+  prototype pollution, information disclosure).
+- A minimal proof of concept or reproduction steps - ideally a sample server
+  response or a short script that triggers the issue.
+- Any suggested remediation, if you have one.
+
+We are a small team, so there is no guaranteed response time - sometimes reports
+are handled within hours, sometimes they take longer. Accepted issues are fixed
+in a new release and coordinated through a GitHub Security Advisory, and
+reporters who wish to be named are credited.
+
+## CVEs
+
+We track and disclose vulnerabilities through GitHub Security Advisories. We do
+not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
+reported issue, please request one yourself - for example, through GitHub's own
+CVE request flow on the published advisory, or another CNA.
+
+## Scope
+
+In scope: the ImapFlow library source in this repository - the IMAP response
+stream and token parser (including handling of hostile or malformed server
+responses, literals, line lengths, and resource/DoS bounds), the TLS and
+STARTTLS upgrade path and certificate handling, credential handling during
+authentication, the command compiler that builds outgoing IMAP commands, and the
+public client API.
+
+Out of scope:
+
+- Vulnerabilities in your own application code that uses ImapFlow.
+- Misconfiguration of your usage - for example, disabling TLS certificate
+  verification (`tls.rejectUnauthorized: false`), connecting over cleartext when
+  TLS is available, or passing untrusted input directly into mailbox paths or
+  command arguments without validation.
+- Vulnerabilities in the IMAP servers you connect to, or in third-party
+  dependencies (please report those to their respective maintainers; we will
+  upgrade once a fix is available).
+- Issues that require an already-compromised host or local access to the machine
+  running ImapFlow.
+- Social-engineering reports and theoretical issues without a demonstrated,
+  concrete impact.
+
+Thank you for helping keep ImapFlow and its users safe.

package/SECURITY.txt

@@ -0,0 +1,27 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+Contact: https://github.com/postalsys/imapflow/security/advisories/new
+Contact: mailto:andris@postalsys.com
+Expires: 2027-06-01T00:00:00.000Z
+Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/5D952A46E1D8C931F6364E01DC6C83F4D584D364
+Preferred-Languages: en, et
+Canonical: https://github.com/postalsys/imapflow/blob/master/SECURITY.txt
+Policy: https://github.com/postalsys/imapflow/blob/master/SECURITY.md
+-----BEGIN PGP SIGNATURE-----
+
+iQJiBAEBCABMFiEEXZUqRuHYyTH2Nk4B3GyD9NWE02QFAmodTFwbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzEhxhbmRyaXNAcmVpbm1hbi5ldQAKCRDcbIP01YTT
+ZGcgD/42Wdd07wEclXDm/lM0Ax+aX9sPjwV33DAICqhDoILf8yG4yPkCRuuTCayw
+QLTB1pCi+tk8xVs9TH88bDwinfGVqzbmUyHSa2h32TDx/0/b+rg2LO2Ru8JtJkX8
+CMY8/UhkouaQnHKDjkbLniF8HpQsBzOiPzvkfX91BY4HBwzE8aCC8MXC0zyjBkQX
+dqVJ/fYMQKPkblKemnrMB/XM1jui2M7vgzpqilLcZqYv5oNFQhgpd+JOEVKMDUZv
+0WaLrFWRegFvFApS/cIvzu5RLIhDWuL0ao577Cpdj1QE7nznfbBqBfGEzZotOShs
+CdzdGloSt9C1gVLWItsncXByXVuNrF8l67hoOAnRwO4c8PKg3b4CvzBelmDiCWrS
+73LGWmFwp1luyLrfZREUYsF5hqHCr6ULmDEAVp0MRtzxL56YjiS20d1sa9v96P4O
+KFCvOT5LbCK/KqAFzhRzRXd3sawt5SXcR2FGgjFrRYNriyHNSk0k1h5IYv1kNoPb
+VN+DxsOhORd2EsqqOBqHoEES472OOsmLTYa0A5z+zyA0IcaY5hXsMDrX9OMIUHUW
+4JAOviDYyejefVJd8SsLrAmQ82p1jPY0LnuIyLz/sXDoe7QduNZIFKoUYw3KVybM
+y0X7yP92/buzcZY41FOQT8dBFGDzboWQo+RPEh16qXEV75ss2A==
+=Wlrz
+-----END PGP SIGNATURE-----

package/lib/commands/store.js

@@ -57,7 +57,7 @@ module.exports = async (connection, range, flags, options) => {
         .map(flag => {
             flag = formatFlag(flag);
 
-            if (!canUseFlag(connection.mailbox, flag) && operation !== 'remove') {
+            if (!canUseFlag(connection.mailbox, flag) && options.operation !== 'remove') {
                 return false;
             }
 

package/lib/handler/imap-stream.js

@@ -16,6 +16,11 @@ const CURLY_CLOSE = 0x7d;
 // Maximum allowed literal size: 1GB (1073741824 bytes)
 const MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
 
+// Default maximum length of a single line (a response without a literal). Matches the literal cap:
+// large literal-free responses (e.g. big SEARCH/LIST results) are legitimate, so this bound exists
+// only to stop a server that never sends a line terminator, not to constrain normal traffic.
+const MAX_LINE_SIZE = MAX_LITERAL_SIZE;
+
 /**
  * A Transform stream that parses raw IMAP protocol data from a socket into structured
  * command/response objects. Reads binary input, splits it into lines delimited by LF,
@@ -34,6 +39,10 @@ class ImapStream extends Transform {
      * @param {Object} [options.logger] - A pino-compatible logger instance. If not provided, a default child logger is created.
      * @param {boolean} [options.logRaw] - If true, logs raw socket data at trace level.
      * @param {boolean} [options.secureConnection] - Whether the connection uses TLS.
+     * @param {number} [options.maxLineLength] - Maximum allowed length (in bytes) of a single
+     *   line (a response without a literal). Defaults to MAX_LITERAL_SIZE (1GB). Guards against a
+     *   malicious or broken server that never sends a line terminator, which would otherwise grow
+     *   the internal line buffer without bound.
      */
     constructor(options) {
         super({
@@ -55,10 +64,15 @@ class ImapStream extends Transform {
 
         this.readBytesCounter = 0;
 
+        // Maximum length of a single line (response without a literal). Bounds the line buffer
+        // so a server that never sends a line terminator cannot exhaust memory.
+        this.maxLineLength = this.options.maxLineLength || MAX_LINE_SIZE;
+
         this.state = LINE;
         this.literalWaiting = 0;
         this.inputBuffer = []; // lines
         this.lineBuffer = []; // current line
+        this.lineBytes = 0; // bytes currently buffered for the in-progress line
         this.literalBuffer = [];
         this.literals = [];
 
@@ -102,7 +116,7 @@ class ImapStream extends Transform {
         // Scan backwards through the line to find an IMAP literal marker: {size}\r\n
         // The format is: '{' followed by one or more ASCII digits followed by '}'
         let numBytes = [];
-        for (; pos > 0; pos--) {
+        for (; pos >= 0; pos--) {
             let c = line[pos];
             if (c >= NUM_0 && c <= NUM_9) {
                 numBytes.unshift(c);
@@ -158,6 +172,7 @@ class ImapStream extends Transform {
 
                         this.inputBuffer.push(line);
                         this.lineBuffer = [];
+                        this.lineBytes = 0;
 
                         // try to detect if this is a literal start
                         if (this.checkLiteralMarker(line)) {
@@ -190,7 +205,21 @@ class ImapStream extends Transform {
                     }
                 }
                 if (lineStart < chunk.length) {
-                    this.lineBuffer.push(chunk.slice(lineStart));
+                    // No line terminator was found in the remaining bytes; carry the tail over to
+                    // the next chunk. Enforce the line-length cap here, since this is the only
+                    // path that grows the line buffer across chunks.
+                    let tail = chunk.slice(lineStart);
+                    let lineLength = this.lineBytes + tail.length;
+                    if (lineLength > this.maxLineLength) {
+                        const err = new Error(`Line length ${lineLength} exceeds maximum allowed size of ${this.maxLineLength} bytes`);
+                        err.code = 'LineTooLarge';
+                        err.lineLength = lineLength;
+                        err.maxSize = this.maxLineLength;
+                        this.emit('error', err);
+                        return;
+                    }
+                    this.lineBytes = lineLength;
+                    this.lineBuffer.push(tail);
                 }
                 break;
             }
@@ -303,6 +332,7 @@ class ImapStream extends Transform {
     _destroy(err, callback) {
         this.inputBuffer = [];
         this.lineBuffer = [];
+        this.lineBytes = 0;
         this.literalBuffer = [];
         this.literals = [];
         // Clear inputQueue and call any pending callbacks

package/lib/handler/token-parser.js

@@ -349,6 +349,13 @@ class TokenParser {
                                     this.currentNode.type = 'ATOM';
                                     // jump i to the ']'
                                     i = this.str.indexOf(']', i + 10);
+                                    if (i < 0) {
+                                        // Malformed REFERRAL with no closing ']'. Consume the rest
+                                        // of the string (there is no ']' to exclude) instead of
+                                        // computing a negative-index substring, which would yield
+                                        // garbage.
+                                        i = this.str.length;
+                                    }
                                     this.currentNode.endPos = this.pos + i - 1;
                                     this.currentNode.value = this.str.substring(this.currentNode.startPos - this.pos, this.currentNode.endPos - this.pos + 1);
                                     this.currentNode = this.currentNode.parentNode;

package/lib/imap-flow.d.ts

@@ -60,6 +60,12 @@ export interface ImapFlowOptions {
     greetingTimeout?: number;
     /** How long to wait for socket inactivity before timing out the connection. Defaults to 5 minutes */
     socketTimeout?: number;
+    /**
+     * Maximum allowed length in bytes of a single response line (a response without a literal).
+     * Guards against a malicious or broken server that never sends a line terminator. Defaults to
+     * 1GB.
+     */
+    maxLineLength?: number;
     /**
      * Threshold in milliseconds for warning that a mailbox lock has been held
      * for a long time (diagnostic for forgotten release() calls). Defaults to

package/lib/imap-flow.js

@@ -291,7 +291,8 @@ class ImapFlow extends EventEmitter {
             logger: this.log,
             cid: this.id,
             logRaw: this.logRaw,
-            secureConnection: this.secureConnection
+            secureConnection: this.secureConnection,
+            maxLineLength: this.options.maxLineLength
         });
 
         this.reading = false;
@@ -1180,6 +1181,24 @@ class ImapFlow extends EventEmitter {
                 reject(err);
             }, UPGRADE_TIMEOUT);
 
+            // A TLS handshake failure (bad certificate, protocol mismatch, etc.) is emitted on the
+            // new TLS socket, not on the plain socket, so it must be handled here. Without this the
+            // upgrade promise would only settle via the timeout and connect() would reject with a
+            // generic "Unexpected close" instead of the actual TLS error.
+            const tlsSocketErrorHandler = err => {
+                clearTimeout(this.connectTimeout);
+                clearTimeout(this.upgradeTimeout);
+                if (!this.upgrading) {
+                    // already settled
+                    return;
+                }
+                this.upgrading = false;
+                err.tlsFailed = true;
+                this.clearSocketHandlers();
+                this.closeAfter();
+                reject(err);
+            };
+
             this.upgrading = true;
             this.socket = tls.connect(opts, () => {
                 try {
@@ -1208,8 +1227,9 @@ class ImapFlow extends EventEmitter {
                         });
                     }
 
-                    // Clean up the plain socket error handler after successful upgrade
+                    // Clean up the error handlers after successful upgrade
                     socketPlain.removeListener('error', socketPlainErrorHandler);
+                    this.socket.removeListener('error', tlsSocketErrorHandler);
 
                     return resolve(true);
                 } catch (ex) {
@@ -1217,6 +1237,11 @@ class ImapFlow extends EventEmitter {
                 }
             });
 
+            // Registered after tls.connect (the TLS socket now exists) but before
+            // setSocketHandlers() so it fires first on a handshake error and removes the generic
+            // handlers, keeping this the single error path for the upgrade.
+            this.socket.once('error', tlsSocketErrorHandler);
+
             this.writeSocket = this.socket;
 
             this.setSocketHandlers();
@@ -3829,6 +3854,7 @@ class ImapFlow extends EventEmitter {
      * @returns {Object} Socket objects
      * @returns {Object} return.readSocket The read socket (inflated socket if compression is enabled, raw socket otherwise)
      * @returns {Object} return.writeSocket The write socket
+     * @returns {Object} return.socket The raw underlying socket (same as readSocket/writeSocket when compression is disabled)
      */
     unbind() {
         this.socket.unpipe(this.streamer);
@@ -3836,15 +3862,32 @@ class ImapFlow extends EventEmitter {
             this._inflate.unpipe(this.streamer);
         }
 
-        this.socket.removeListener('error', this._socketError);
-        this.socket.removeListener('close', this._socketClose);
-        this.socket.removeListener('end', this._socketEnd);
-        this.socket.removeListener('tlsClientError', this._socketError);
-        this.socket.removeListener('timeout', this._socketTimeout);
+        // Detach all of ImapFlow's socket listeners — the raw socket plus, when
+        // compression is active, the PassThrough writeSocket — so the connection
+        // is fully released to the caller.
+        this.clearSocketHandlers();
+
+        const readSocket = this._inflate || this.socket;
+        const writeSocket = this.writeSocket || this.socket;
+
+        // Defense-in-depth: when compression is active the raw socket is orphaned
+        // (neither readSocket nor writeSocket) yet still live and still the target
+        // of the deflate/writeSocket error forwarders. We just stripped our own
+        // error listener, so any post-unbind error (e.g. an upstream ECONNRESET)
+        // would become an unhandled 'error' that crashes the host process. Attach
+        // a benign listener so the orphaned socket can never throw after handoff.
+        // Non-compression path: socket === readSocket === writeSocket and the
+        // caller owns it directly, so leave it untouched (no behavior change).
+        if (this.socket !== readSocket && this.socket !== writeSocket) {
+            this.socket.on('error', err => {
+                this.log.debug({ msg: 'Suppressed error on unbound socket', err, cid: this.id });
+            });
+        }
 
         return {
-            readSocket: this._inflate || this.socket,
-            writeSocket: this.writeSocket || this.socket
+            readSocket,
+            writeSocket,
+            socket: this.socket
         };
     }
 }

package/lib/tools.js

@@ -383,6 +383,10 @@ const tools = {
                 if (Array.isArray(attribute)) {
                     return attribute.map(entry => (entry && typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
                 }
+                // NIL (parsed as null) and other non-array values yield an empty array,
+                // so callers can safely index into the result. RFC 8474 allows e.g.
+                // `THREADID NIL` when the server has no thread relation to report.
+                return [];
             };
 
             switch (key) {
@@ -490,7 +494,7 @@ const tools = {
 
             // normalize path to use ascii, so we would always get the same ID
             let path = mailbox.path;
-            if (/[0x80-0xff]/.test(path)) {
+            if (/[\u0080-\uffff]/.test(path)) {
                 try {
                     path = iconv.encode(path, 'utf-7-imap').toString();
                 } catch {
@@ -1065,7 +1069,9 @@ const tools = {
             return '';
         }
 
-        list.sort((a, b) => a - b);
+        // Deduplicate before sorting so that repeated values do not produce
+        // overlapping/non-canonical tokens (e.g. [1,1,2,3] -> "1:3", not "1,1:3").
+        list = Array.from(new Set(list)).sort((a, b) => a - b);
 
         let last = list[list.length - 1];
         let result = [[last]];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.3.3",
+    "version": "1.3.5",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",
@@ -28,9 +28,9 @@
     "homepage": "https://imapflow.com/",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "@types/node": "25.6.0",
+        "@types/node": "25.9.1",
         "c8": "11.0.0",
-        "eslint": "10.2.1",
+        "eslint": "10.4.1",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.2",
@@ -42,14 +42,14 @@
         "typescript": "6.0.3"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.9",
+        "@zone-eu/mailsplit": "5.4.12",
         "encoding-japanese": "2.2.0",
         "iconv-lite": "0.7.2",
         "libbase64": "1.3.0",
         "libmime": "5.3.8",
         "libqp": "2.1.1",
-        "nodemailer": "8.0.7",
+        "nodemailer": "8.0.10",
         "pino": "10.3.1",
-        "socks": "2.8.8"
+        "socks": "2.8.9"
     }
 }

package/test/commands-integration-test.js

@@ -582,6 +582,51 @@ module.exports['Commands: store remove flags'] = async test => {
     test.done();
 };
 
+module.exports['Commands: store remove keeps a flag not in permanentFlags'] = async test => {
+    // Mailbox permits only \Seen (no \*), so \Custom is not a permanent flag. Removal must still be
+    // sent: a flag does not need to be permitted to be removed. Regression guard — the check used
+    // to test the rewritten wire-form operation instead of options.operation and dropped the flag.
+    let execArgs = null;
+    const connection = createMockConnection({
+        state: 3,
+        mailbox: { permanentFlags: new Set(['\\Seen']) },
+        exec: async (cmd, attrs) => {
+            execArgs = { cmd, attrs };
+            return { next: () => {} };
+        }
+    });
+
+    const result = await storeCommand(connection, '1:10', ['\\Custom'], { operation: 'remove' });
+    test.equal(result, true);
+    test.ok(execArgs, 'a STORE command should be issued');
+    test.equal(execArgs.attrs[1].value, '-FLAGS');
+    test.deepEqual(
+        execArgs.attrs[2].map(flag => flag.value),
+        ['\\Custom'],
+        'the removed flag must be present in the command'
+    );
+    test.done();
+};
+
+module.exports['Commands: store add drops a flag not in permanentFlags'] = async test => {
+    // Control for the regression above: the permanentFlags guard must still apply to non-remove
+    // operations. Adding a flag the mailbox does not permit yields no command and a false result.
+    let execCalled = false;
+    const connection = createMockConnection({
+        state: 3,
+        mailbox: { permanentFlags: new Set(['\\Seen']) },
+        exec: async () => {
+            execCalled = true;
+            return { next: () => {} };
+        }
+    });
+
+    const result = await storeCommand(connection, '1:10', ['\\Custom'], { operation: 'add' });
+    test.equal(result, false, 'adding a non-permitted flag should fail');
+    test.equal(execCalled, false, 'no STORE command should be issued');
+    test.done();
+};
+
 module.exports['Commands: store set flags'] = async test => {
     let execArgs = null;
     const connection = createMockConnection({

package/test/connection-edge-cases-test.js

@@ -1067,6 +1067,8 @@ module.exports['Connection Edge: unbind removes socket listeners and returns soc
     test.ok(result.writeSocket, 'Should return writeSocket');
     test.equal(result.readSocket, client.socket);
     test.equal(result.writeSocket, client.socket);
+    // Non-compression path: the raw socket is the same object as read/write.
+    test.equal(result.socket, client.socket);
 
     test.done();
 };
@@ -1103,6 +1105,72 @@ module.exports['Connection Edge: unbind with inflate stream'] = test => {
     test.done();
 };
 
+module.exports['Connection Edge: unbind survives post-handoff socket error (compression)'] = test => {
+    let client = new ImapFlow({
+        host: 'imap.example.com',
+        port: 993,
+        auth: { user: 'test', pass: 'test' }
+    });
+
+    // Mock the compression topology: raw socket plus a separate PassThrough-like
+    // writeSocket, an inflate read stream and a deflate stream. The writeSocket
+    // and deflate error forwarders re-emit onto the raw socket, exactly like compress().
+    client.socket = new EventEmitter();
+    client.socket.unpipe = () => {};
+
+    client.writeSocket = new EventEmitter();
+    client.writeSocket.on('error', err => {
+        if (client.socket) {
+            client.socket.emit('error', err);
+        }
+    });
+
+    client._inflate = new EventEmitter();
+    client._inflate.unpipe = () => {};
+
+    client._deflate = new EventEmitter();
+    client._deflate.on('error', err => {
+        if (client.socket) {
+            client.socket.emit('error', err);
+        }
+    });
+
+    client.setSocketHandlers();
+
+    let result = client.unbind();
+
+    // Explicit contract: raw socket is now exposed alongside read/write sockets.
+    test.equal(result.socket, client.socket, 'Should expose the raw socket');
+    test.equal(result.readSocket, client._inflate);
+    test.equal(result.writeSocket, client.writeSocket);
+
+    // ImapFlow's own _socketError must be detached from writeSocket; only the
+    // forwarder closure remains.
+    test.equal(client.writeSocket.listenerCount('error'), 1);
+
+    // Emitting 'error' on a listener-less EventEmitter throws synchronously, so
+    // each of these would crash the host before the fix. After unbind() the
+    // benign listener on the orphaned raw socket must swallow them all.
+    test.doesNotThrow(() => {
+        client.socket.emit('error', Object.assign(new Error('upstream reset'), { code: 'ECONNRESET' }));
+    }, 'Direct socket error after unbind must not throw');
+
+    test.doesNotThrow(() => {
+        client.writeSocket.emit('error', new Error('write failure'));
+    }, 'writeSocket error forwarded to the raw socket must not throw');
+
+    test.doesNotThrow(() => {
+        client._deflate.emit('error', new Error('deflate failure'));
+    }, 'deflate error forwarded to the raw socket must not throw');
+
+    // close() must remain safe to call after unbind().
+    test.doesNotThrow(() => {
+        client.close();
+    }, 'close() after unbind must not throw');
+
+    test.done();
+};
+
 module.exports['Connection Edge: resolveRange with number input'] = async test => {
     let client = new ImapFlow({
         host: 'imap.example.com',

package/test/imap-stream-edge-cases-test.js

@@ -266,3 +266,71 @@ module.exports['logRaw option triggers trace logging'] = test => {
 
     stream.end(Buffer.from('A CMD\r\n'));
 };
+
+module.exports['Adjacent literals with marker at line start'] = test => {
+    // After the first literal's data (12345) is consumed, parsing resumes at the very start of
+    // a line that is itself a literal marker ({3}). The marker begins at byte 0 of the resumed
+    // line, which the backward scan must still recognize. Previously the loop bound skipped
+    // index 0, so the second literal was silently dropped.
+    runStreamTest(
+        test,
+        cmd => {
+            test.equal(cmd.literals.length, 2, 'both adjacent literals must be extracted');
+            test.equal(cmd.literals[0].toString(), '12345', 'first literal content');
+            test.equal(cmd.literals[1].toString(), 'ABC', 'second literal content');
+        },
+        async stream => {
+            stream.end(Buffer.from('A LOGIN {5}\r\n12345{3}\r\nABC\r\n'));
+        },
+        1
+    );
+};
+
+module.exports['Line length cap rejects oversized line'] = test => {
+    // A server that never sends a line terminator must not grow the line buffer without bound.
+    const stream = new ImapStream({ cid: 'test', maxLineLength: 16 });
+    let errored = false;
+
+    stream.on('error', err => {
+        errored = true;
+        test.equal(err.code, 'LineTooLarge', 'error code should be LineTooLarge');
+        test.equal(err.maxSize, 16, 'error should report the configured cap');
+        stream.destroy();
+        test.done();
+    });
+
+    stream.on('end', () => {
+        if (!errored) {
+            test.ok(false, 'expected a LineTooLarge error');
+            test.done();
+        }
+    });
+
+    // 24 bytes, no LF, written across chunks -> exceeds the 16 byte cap.
+    stream.write(Buffer.from('AAAAAAAA'));
+    stream.write(Buffer.from('BBBBBBBB'));
+    stream.write(Buffer.from('CCCCCCCC'));
+};
+
+module.exports['Line length cap allows line within limit'] = test => {
+    // A normal line under the configured cap must still parse cleanly.
+    const stream = new ImapStream({ cid: 'test', maxLineLength: 32 });
+    let payloads = [];
+
+    stream.on('readable', () => {
+        let cmd;
+        while ((cmd = stream.read()) !== null) {
+            payloads.push(cmd.payload.toString());
+            cmd.next();
+        }
+    });
+
+    stream.on('error', err => test.ifError(err));
+
+    stream.on('end', () => {
+        test.deepEqual(payloads, ['A NOOP'], 'line under the cap should parse');
+        test.done();
+    });
+
+    stream.end(Buffer.from('A NOOP\r\n'));
+};

package/test/token-parser-test.js

@@ -372,3 +372,21 @@ module.exports['Token Parser: E34: digit after star throws ParserError34'] = tes
         test.ok(err, 'expected an error to be thrown');
         test.equal(err.code, 'ParserError34');
     });
+
+module.exports['Token Parser: REFERRAL response code is parsed as an IMAP URL atom'] = test =>
+    asyncWrapper(test, async test => {
+        let r = await parser('* OK [REFERRAL imap://user@host/INBOX] please use another server');
+        let section = r.attributes[0].section;
+        test.equal(section[0].value, 'REFERRAL');
+        test.equal(section[1].value, 'imap://user@host/INBOX');
+    });
+
+module.exports['Token Parser: malformed REFERRAL with no closing bracket consumes the rest'] = test =>
+    asyncWrapper(test, async test => {
+        // Missing ']' previously produced a negative-index substring (garbage). The whole
+        // remaining string should be captured as the URL instead, without throwing.
+        let r = await parser('* OK [REFERRAL imap://user@host/INBOX');
+        let section = r.attributes[0].section;
+        test.equal(section[0].value, 'REFERRAL');
+        test.equal(section[1].value, 'imap://user@host/INBOX');
+    });

package/test/tools-test.js

@@ -1,6 +1,9 @@
 'use strict';
 
 const tools = require('../lib/tools');
+const { parser } = require('../lib/handler/imap-handler');
+const crypto = require('crypto');
+const iconv = require('iconv-lite');
 
 // Mock connection for testing
 let createMockConnection = (options = {}) => ({
@@ -1137,3 +1140,69 @@ module.exports['Tools: getColorFlags with null returns result not null'] = test
     test.ok(result.remove.includes('\\Flagged'));
     test.done();
 };
+
+// ============================================
+// formatMessageResponse: OBJECTID NIL handling (RFC 8474)
+// ============================================
+
+module.exports['Tools: formatMessageResponse handles THREADID NIL'] = async test => {
+    // RFC 8474 allows `THREADID NIL` when the server has no thread relation to
+    // report (e.g. Strato). The NIL token is parsed as null and must not crash.
+    let untagged = await parser('* 1 FETCH (UID 1 EMAILID (E1) THREADID NIL FLAGS (\\Seen) MODSEQ (4312))');
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.seq, 1);
+    test.equal(result.uid, 1);
+    test.equal(result.emailId, 'E1');
+    test.equal(result.threadId, undefined);
+    test.ok(result.flags.has('\\Seen'));
+    test.equal(result.modseq, 4312n);
+    test.done();
+};
+
+module.exports['Tools: formatMessageResponse handles normal THREADID'] = async test => {
+    let untagged = await parser('* 2 FETCH (THREADID (T9999) EMAILID (E2))');
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.threadId, 'T9999');
+    test.equal(result.emailId, 'E2');
+    test.done();
+};
+
+// ============================================
+// formatMessageResponse: non-ASCII mailbox path normalization for stable id
+// ============================================
+
+module.exports['Tools: formatMessageResponse normalizes non-ASCII mailbox path for id'] = async test => {
+    // No EMAILID, so the message id falls back to an md5 over [path, uidValidity, uid].
+    // The mailbox path is non-ASCII and must be modified-UTF-7 normalized before hashing.
+    // (A previous bogus regex /[0x80-0xff]/ never matched non-ASCII, skipping normalization.)
+    let untagged = await parser('* 1 FETCH (UID 5 FLAGS (\\Seen))');
+    let mailbox = { path: '日本語', uidValidity: 123n };
+    let result = await tools.formatMessageResponse(untagged, mailbox);
+
+    let encodedPath = iconv.encode('日本語', 'utf-7-imap').toString();
+    let expectedId = crypto.createHash('md5').update([encodedPath, '123', '5'].join(':')).digest('hex');
+    let rawId = crypto.createHash('md5').update(['日本語', '123', '5'].join(':')).digest('hex');
+
+    test.equal(result.id, expectedId, 'id must hash the UTF-7 normalized path');
+    test.notEqual(result.id, rawId, 'id must not hash the raw non-ASCII path');
+    test.done();
+};
+
+// ============================================
+// packMessageRange
+// ============================================
+
+module.exports['Tools: packMessageRange packs contiguous and gapped ranges'] = test => {
+    test.equal(tools.packMessageRange([1, 2, 3, 5, 7, 8]), '1:3,5,7:8');
+    test.equal(tools.packMessageRange(7), '7');
+    test.equal(tools.packMessageRange([]), '');
+    test.done();
+};
+
+module.exports['Tools: packMessageRange dedupes duplicate values'] = test => {
+    // Duplicates must not produce overlapping/non-canonical tokens like "1,1:3".
+    test.equal(tools.packMessageRange([1, 1, 2, 3]), '1:3');
+    test.equal(tools.packMessageRange([3, 1, 2, 2, 5]), '1:3,5');
+    test.equal(tools.packMessageRange([5, 5, 5]), '5');
+    test.done();
+};