imapflow 1.6.3 → 1.6.4

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.3"
+    ".": "1.6.4"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.6.4](https://github.com/postalsys/imapflow/compare/v1.6.3...v1.6.4) (2026-07-29)
+
+
+### Bug Fixes
+
+* block IMAP command injection and harden rev2 protocol handling ([e107292](https://github.com/postalsys/imapflow/commit/e107292bc907b29d94b0d810dc01e9680f820bfa))
+
 ## [1.6.3](https://github.com/postalsys/imapflow/compare/v1.6.2...v1.6.3) (2026-07-28)
 
 

package/lib/commands/compress.js

@@ -19,7 +19,23 @@ module.exports = async connection => {
     let response;
     try {
         response = await connection.exec('COMPRESS', [{ type: 'ATOM', value: 'DEFLATE' }]);
+        // Everything after the tagged OK is already deflate-framed (RFC 4978 section 4).
+        // The socket stays piped into the plaintext parser until this call returns, so
+        // bytes that arrived in the same chunk as the OK have been consumed as cleartext
+        // and are missing from the head of the deflate stream - the inflater would then
+        // fail and take the connection with it. Rare (it needs the server to write again
+        // before we re-pipe), and staying uncompressed is a cheaper outcome than a dead
+        // connection, so decline the upgrade instead.
+        // This only covers the bytes the parser had already buffered when the OK was
+        // handled. Closing the remaining window, and keeping compression rather than
+        // dropping it, needs the stream to hand back its unconsumed tail on unpipe so
+        // the transport can feed it into the inflater - not something a command module
+        // can reach from here.
         response.next();
+        if (response.hasTrailingData) {
+            connection.log.warn({ msg: 'Server sent data immediately after the COMPRESS response, skipping compression', cid: connection.id });
+            return false;
+        }
         return true;
     } catch (err) {
         connection.log.warn({ err, cid: connection.id });

package/lib/commands/search.js

@@ -27,6 +27,8 @@ const stripEsearchPrefix = attrs => {
  *
  * ALL and PARTIAL.messages are kept as compact sequence-set strings.
  * Use expandRange() from tools.js if you need to expand them.
+ * MODSEQ (RFC 7162, sent when the search used a MODSEQ criterion) is
+ * returned as a BigInt.
  *
  * @param {Array} attrs - Attribute array from the IMAP parser
  * @returns {Object} ESearchResult object
@@ -61,6 +63,14 @@ function parseEsearchResponse(attrs) {
                 if (!isNaN(n)) result.max = n;
                 break;
             }
+            case 'MODSEQ': {
+                // RFC 7162 section 3.1.5: present when the SEARCH used a MODSEQ
+                // criterion on a CONDSTORE-enabled session. BigInt because
+                // mod-sequence values are unsigned 63-bit
+                const value = attrs[++i]?.value;
+                if (typeof value === 'string' && /^\d+$/.test(value)) result.modseq = BigInt(value);
+                break;
+            }
             case 'ALL': {
                 const allToken = attrs[++i];
                 if (allToken && typeof allToken.value === 'string') {

package/lib/handler/imap-compiler.js

@@ -4,6 +4,39 @@
 
 const imapFormalSyntax = require('./imap-formal-syntax');
 
+// A sequence-set as defined by the RFC 9051 grammar: comma-separated numbers and
+// ranges, where "*" stands for the largest number in use. Digit strings are not
+// range-checked here (a server rejects "0" or an overlong number on its own); the
+// point of the check is that nothing outside this alphabet can reach the wire.
+const SEQUENCE_SET = /^(\d+|\*)(:(\d+|\*))?(,(\d+|\*)(:(\d+|\*))?)*$/;
+
+// Characters that cannot appear in an IMAP quoted string: CR and LF terminate a
+// command line, and NUL is outside the CHAR production entirely. A value carrying
+// any of them has to be sent as a literal, so quoting it is never correct.
+const NOT_QUOTABLE = /[\r\n\0]/;
+
+// A line terminator ends an IMAP command, so no token may carry one to the wire.
+const CRLF = /[\r\n]/;
+
+/**
+ * Quotes a value as an IMAP quoted string. Only DQUOTE and backslash are escaped -
+ * the IMAP grammar defines no other escape sequence, so JSON-style escaping (which
+ * turns a tab into a literal backslash-t and a control character into \\uXXXX) would
+ * silently change the value the server receives.
+ *
+ * @param {string} value - The value to quote.
+ * @returns {string} The quoted string, ready to be written to the wire.
+ * @throws {Error} If the value contains CR, LF or NUL, which a quoted string cannot carry.
+ */
+const quoteString = value => {
+    if (NOT_QUOTABLE.test(value)) {
+        let error = new Error('Unquotable character in IMAP string value');
+        error.code = 'InvalidStringValue';
+        throw error;
+    }
+    return '"' + value.replace(/["\\]/g, char => '\\' + char) + '"';
+};
+
 /**
  * Formats a response entry into a Buffer.
  *
@@ -111,7 +144,7 @@ module.exports = async (response, options) => {
             if (isLogging && node.length > 100) {
                 resp.push(formatRespEntry('"(* ' + node.length + 'B string *)"'));
             } else {
-                resp.push(formatRespEntry(JSON.stringify(node.toString())));
+                resp.push(formatRespEntry(isLogging ? JSON.stringify(node.toString()) : quoteString(node.toString())));
             }
             return;
         }
@@ -168,19 +201,51 @@ module.exports = async (response, options) => {
                 if (isLogging && node.value.length > 100) {
                     resp.push(formatRespEntry('"(* ' + node.value.length + 'B string *)"'));
                 } else {
-                    resp.push(formatRespEntry(JSON.stringify((node.value || '').toString())));
+                    val = (node.value || '').toString();
+                    resp.push(formatRespEntry(isLogging ? JSON.stringify(val) : quoteString(val)));
                 }
                 break;
 
-            case 'TEXT':
             case 'SEQUENCE':
+                // Sequence sets are written verbatim - they are the one token type with
+                // no quoting to fall back on. Callers build them from user-supplied
+                // ranges, so validate here, at the single point every outgoing sequence
+                // set passes through, rather than trusting each command module. Values
+                // the parser produced for a server response are already within this
+                // alphabet, so re-compiling a response (logging, error text) is unaffected.
+                if (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value)) {
+                    val = node.value.toString();
+                    if (val && !SEQUENCE_SET.test(val)) {
+                        let error = new Error('Invalid sequence set value');
+                        error.code = 'InvalidSequenceSet';
+                        throw error;
+                    }
+                }
                 if (node.value) {
                     resp.push(formatRespEntry(node.value));
                 }
                 break;
 
+            case 'TEXT':
+                // Response text is written verbatim. Only the parser produces it today, for
+                // incoming lines, so this is a re-encoding path rather than a command-building
+                // one - but the choke point is only worth anything if it holds for every token
+                // type, so a line terminator is refused here too.
+                if (node.value) {
+                    if (!isLogging && CRLF.test(node.value.toString())) {
+                        let error = new Error('Line terminator in IMAP text value');
+                        error.code = 'InvalidTextValue';
+                        throw error;
+                    }
+                    resp.push(formatRespEntry(node.value));
+                }
+                break;
+
             case 'NUMBER':
-                resp.push(formatRespEntry(node.value || 0));
+                // Coerced rather than written through: formatRespEntry passes a string or
+                // Buffer straight to the wire, so a numeric token carrying a string value
+                // would be another verbatim channel
+                resp.push(formatRespEntry(Math.round(Number(node.value)) || 0));
                 break;
 
             case 'ATOM':
@@ -192,7 +257,7 @@ module.exports = async (response, options) => {
                     // Strip a leading backslash before checking (system flags like \Seen start with '\').
                     // If any character fails verification, quote-escape the entire value with JSON.stringify.
                     if (node.value === '' || imapFormalSyntax.verify(val.charAt(0) === '\\' ? val.substr(1) : val, imapFormalSyntax['ATOM-CHAR']()) >= 0) {
-                        val = JSON.stringify(val);
+                        val = isLogging ? JSON.stringify(val) : quoteString(val);
                     }
 
                     resp.push(formatRespEntry(val));
@@ -209,9 +274,13 @@ module.exports = async (response, options) => {
 
                     resp.push(formatRespEntry(']'));
                 }
-                // Partial range: emit <origin.length> after the section brackets
+                // Partial range: emit <origin.length> after the section brackets. Coerced
+                // rather than joined as-is: this is the last token component written
+                // verbatim, and the choke point is only worth relying on if it holds for
+                // all of them. Every producer already passes numbers, so nothing changes
+                // for them.
                 if (node.partial) {
-                    resp.push(formatRespEntry(`<${node.partial.join('.')}>`));
+                    resp.push(formatRespEntry(`<${node.partial.map(entry => Number(entry) || 0).join('.')}>`));
                 }
                 break;
         }

package/lib/handler/imap-stream.js

@@ -165,16 +165,24 @@ class ImapStream extends Transform {
         pos--;
 
         // Scan backwards through the line to find an IMAP literal marker: {size}\r\n
-        // The format is: '{' followed by one or more ASCII digits followed by '}'
-        let numBytes = [];
+        // The format is: '{' followed by one or more ASCII digits followed by '}'.
+        // Only the digit run's bounds are tracked, and the run is capped: the size is
+        // a number64 at most, so anything longer cannot be a valid marker. Collecting
+        // the digits into a growing array instead would make a line of n digits cost
+        // O(n^2), letting a few hundred KB of digits block the event loop for seconds
+        // before the size is even known - well inside the default line-length cap.
+        const MAX_SIZE_DIGITS = 19;
+        let digitsEnd = pos;
         for (; pos >= 0; pos--) {
             let c = line[pos];
             if (c >= NUM_0 && c <= NUM_9) {
-                numBytes.unshift(c);
+                if (digitsEnd - pos >= MAX_SIZE_DIGITS) {
+                    return false;
+                }
                 continue;
             }
-            if (c === CURLY_OPEN && numBytes.length) {
-                const literalSize = Number(Buffer.from(numBytes).toString());
+            if (c === CURLY_OPEN && pos < digitsEnd) {
+                const literalSize = Number(line.toString('latin1', pos + 1, digitsEnd + 1));
 
                 if (literalSize > this.maxLiteralSize) {
                     return this.failStream(createLiteralTooLargeError(literalSize, this.maxLiteralSize));

package/lib/handler/parser-instance.js

@@ -77,8 +77,13 @@ class ParserInstance {
                 {
                     let match = this.remainder.match(/^\s+\[/);
                     if (match) {
+                        // Find the ']' that closes the response code. Inner brackets are
+                        // tracked because servers do put bracketed values inside a code
+                        // (e.g. a "[css3-page]" keyword in a PERMANENTFLAGS list), which a
+                        // first-']' scan would cut in half.
                         let nesting = 1;
-                        for (let i = match[0].length; i <= this.remainder.length; i++) {
+                        let end = -1;
+                        for (let i = match[0].length; i < this.remainder.length; i++) {
                             let c = this.remainder[i];
 
                             if (c === '[') {
@@ -87,11 +92,25 @@ class ParserInstance {
                                 nesting--;
                             }
                             if (!nesting) {
-                                this.humanReadable = this.remainder.substring(i + 1).trim();
-                                this.remainder = this.remainder.substring(0, i + 1);
+                                end = i;
                                 break;
                             }
                         }
+
+                        // Unbalanced '[' inside the code: the RFC 9051 free-text form
+                        // (`atom [SP 1*<any TEXT-CHAR except "]">]`) permits '[' but not
+                        // ']', so the code really does end at the first ']' here. Without
+                        // this fallback the scan finds no closing bracket at all and the
+                        // human-readable text - what every error message is built from -
+                        // is swallowed into the response code.
+                        if (end < 0) {
+                            end = this.remainder.indexOf(']', match[0].length);
+                        }
+
+                        if (end >= 0) {
+                            this.humanReadable = this.remainder.substring(end + 1).trim();
+                            this.remainder = this.remainder.substring(0, end + 1);
+                        }
                     } else {
                         this.humanReadable = this.remainder.trim();
                         this.remainder = '';

package/lib/imap-flow.d.ts

@@ -699,6 +699,8 @@ export interface ESearchResult {
         /** Matching UIDs in that range as compact sequence-set */
         messages: string;
     };
+    /** Highest mod-sequence of the matching messages (RFC 7162, present when the search used a modseq criterion on a CONDSTORE session) */
+    modseq?: bigint;
 }
 
 export class AuthenticationFailure extends Error {

package/lib/imap-flow.js

@@ -834,6 +834,33 @@ class ImapFlow extends EventEmitter {
         }
     }
 
+    /**
+     * Fails the in-flight command when a line that could not be parsed was addressed to its tag.
+     * Only the leading tag is read from the raw payload - the rest of the line is by definition
+     * not trustworthy - and only the command that is actually on the wire may be settled this way,
+     * the same invariant the parsed tagged-response path enforces.
+     *
+     * @param {Buffer} payload - Raw bytes of the line that failed to parse.
+     * @param {Error} parserError - The error the parser raised.
+     */
+    rejectUnparsedCompletion(payload, parserError) {
+        if (!this.currentRequest || !this.currentRequest.sent) {
+            return;
+        }
+
+        let tag = payload.toString('latin1', 0, 64).match(/^(\S+)/);
+        if (!tag || tag[1] !== this.currentRequest.tag) {
+            return;
+        }
+
+        let err = new Error('Failed to parse the server response for this command');
+        err.code = parserError.code || 'ParserError';
+        err.parserError = parserError;
+        this.rejectCurrentRequest(err);
+
+        this.trySend().catch(sendErr => this.log.warn({ err: sendErr, cid: this.id }));
+    }
+
     /**
      * Handles a single parsed server response: telemetry, continuation requests, response-code
      * section handlers, untagged handlers and tagged command completion.
@@ -863,6 +890,14 @@ class ImapFlow extends EventEmitter {
         } catch (err) {
             // can not make sense of this
             this.log.error({ src: 's', msg: data.payload.toString(), err, cid: this.id });
+            // An unparseable untagged line is junk that can be skipped, but the line may
+            // have been the in-flight command's tagged completion. Dropping that one
+            // silently strands the command: currentRequest is never cleared, so trySend()
+            // stops dispatching and every later command queues behind it until the socket
+            // timeout fires. The tag is recovered from the raw bytes (a tag is
+            // ASTRING-CHAR only, so it survives whatever made the rest unparseable) and
+            // the command is failed with the parser error instead of hanging.
+            this.rejectUnparsedCompletion(data.payload, err);
             return true;
         }
 
@@ -1629,11 +1664,14 @@ class ImapFlow extends EventEmitter {
             this.writeSocket = this.socket;
         });
 
-        if (upgraded && this.expectCapabilityUpdate) {
-            // After STARTTLS the server may advertise a different capability set
-            // (e.g., LOGINDISABLED removed, new AUTH= methods). Clear the pre-TLS
-            // map before re-fetching so stale capabilities cannot leak through
-            // if the CAPABILITY response is delayed or absent.
+        if (upgraded) {
+            // RFC 9051 section 6.2.1: once TLS is started the client MUST discard the
+            // cached capabilities and reissue CAPABILITY, because everything learned
+            // before the handshake was plaintext an active attacker could rewrite.
+            // Unconditional on purpose: a server that stamps [CAPABILITY ...] on the
+            // STARTTLS OK itself clears expectCapabilityUpdate, so keying the discard
+            // on that flag would keep exactly the pre-TLS list an attacker controls -
+            // the list that then picks the AUTH mechanism and answers LOGINDISABLED.
             this.capabilities.clear();
             this.authCapabilities.clear();
             await this.run('CAPABILITY');

package/lib/search-compiler.js

@@ -233,10 +233,13 @@ module.exports.searchCompiler = (connection, query) => {
                     }
                     break;
 
-                // UID sequences
+                // UID sequences. The key stays an ATOM and only the value is a
+                // SEQUENCE token, so the compiler validates the sequence set
+                // itself rather than the "UID" keyword in front of it.
                 case 'UID':
                     if (params[term]) {
-                        setOpt(attributes, term, params[term], 'SEQUENCE');
+                        attributes.push({ type: 'ATOM', value: 'UID' });
+                        [].concat(params[term]).forEach(entry => attributes.push({ type: 'SEQUENCE', value: (entry ?? '').toString() }));
                     }
                     break;
 

package/lib/tools.js

@@ -20,9 +20,13 @@ const EXPANDED_RANGE_LIMIT = 0x1000000;
 // When IMAP4rev2 is active, these are available even without their own capability
 // token. BINARY is deliberately excluded - RFC 9051 only folds in the FETCH side,
 // which fetch.js handles with its own isRev2Active check, while the APPEND side
-// stays gated on the BINARY token. The set mirrors the Appendix E list in full,
-// including entries no call site consults yet, so any future capability check
-// gets the rev2 folding for free.
+// stays gated on the BINARY token. SPECIAL-USE is a partial fold: Appendix E only
+// folds in the special-use mailbox attributes, not the RFC 6154 LIST selection and
+// RETURN options - the only call sites that act on this entry are in list.js,
+// where a staged retry ladder recovers if a rev2-only server rejects the RETURN
+// option. The set mirrors the rest of the Appendix E list in full, including
+// entries no call site consults yet, so any future capability check gets the
+// rev2 folding for free.
 const IMAP4REV2_FOLDED_CAPABILITIES = new Set([
     'ENABLE',
     'ESEARCH',
@@ -308,7 +312,17 @@ const tools = {
             return false;
         }
 
-        return (await compiler(response)).toString();
+        try {
+            return (await compiler(response)).toString();
+        } catch {
+            // The wire encoder refuses values that cannot be expressed as a valid IMAP
+            // string, which is what keeps user-supplied data from breaking out of a
+            // command. A server response is not held to that: the parser deliberately
+            // tolerates stray bytes inside an OK/NO/BAD atom, and those bytes then have
+            // no valid re-encoding. This text is diagnostic, so fall back to the logging
+            // encoder rather than replacing the server's error with an encoding failure.
+            return (await compiler(response, { isLogging: true })).toString();
+        }
     },
 
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.6.3",
+    "version": "1.6.4",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",

package/test/commands-integration-test.js

@@ -606,6 +606,97 @@ module.exports['Commands: search drops * from ESEARCH UID results'] = async test
     test.done();
 };
 
+module.exports['Commands: search discards invalid single values in an ESEARCH ALL set'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        mailbox: { path: 'INBOX', exists: 5 },
+        exec: async (cmd, attrs, opts) => {
+            // '0' is not a valid nz-number and 'foo' is garbage - both single
+            // values must be dropped while the valid one survives
+            await opts.untagged.ESEARCH({
+                attributes: [
+                    { type: 'ATOM', value: 'ALL' },
+                    { type: 'ATOM', value: '0,foo,4' }
+                ]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await searchCommand(connection, true, {});
+    test.deepEqual(result, [4]);
+    test.done();
+};
+
+module.exports['Commands: search truncates single-value ESEARCH ALL entries at the mailbox size'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        mailbox: { path: 'INBOX', exists: 2 },
+        exec: async (cmd, attrs, opts) => {
+            // More single values than the mailbox holds - the walk must stop at
+            // the EXISTS budget instead of collecting the excess
+            await opts.untagged.ESEARCH({
+                attributes: [
+                    { type: 'ATOM', value: 'ALL' },
+                    { type: 'ATOM', value: '1,2,3,4' }
+                ]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await searchCommand(connection, true, {});
+    test.deepEqual(result, [1, 2]);
+    test.done();
+};
+
+module.exports['Commands: search ignores an ESEARCH reply without attributes on the plain path'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        exec: async (cmd, attrs, opts) => {
+            // A degenerate untagged ESEARCH with no attributes must not crash
+            // the collector or contribute results
+            await opts.untagged.ESEARCH({ attributes: null });
+            await opts.untagged.ESEARCH({
+                attributes: [
+                    { type: 'ATOM', value: 'ALL' },
+                    { type: 'ATOM', value: '2' }
+                ]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await searchCommand(connection, true, {});
+    test.deepEqual(result, [2]);
+    test.done();
+};
+
+module.exports['Commands: search treats an ESEARCH ALL set without a mailbox size as empty'] = async test => {
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([['IMAP4rev2', true]]),
+        // No exists value at all - the budget is zero, nothing may be collected
+        mailbox: { path: 'INBOX' },
+        exec: async (cmd, attrs, opts) => {
+            await opts.untagged.ESEARCH({
+                attributes: [
+                    { type: 'ATOM', value: 'ALL' },
+                    { type: 'ATOM', value: '1:3' }
+                ]
+            });
+            return { next: () => {} };
+        }
+    });
+
+    const result = await searchCommand(connection, true, {});
+    test.deepEqual(result, []);
+    test.done();
+};
+
 module.exports['Commands: search with UID option'] = async test => {
     let execCmd = null;
     const connection = createMockConnection({

package/test/imap-compiler-test.js

@@ -639,3 +639,101 @@ module.exports['IMAP Compiler: partial range in SECTION'] = test =>
         ).toString();
         test.ok(compiled.includes('<0.50>'), 'should contain partial range <0.50>');
     });
+
+// Returns the error a compile attempt raised, or undefined when it succeeded.
+// Several cases below assert that a token can never reach the wire, and the
+// try/catch is the only interesting part of each.
+const compileError = async attributes => {
+    try {
+        await compiler({ tag: 'A', command: 'CMD', attributes });
+    } catch (err) {
+        return err;
+    }
+};
+
+module.exports['IMAP Compiler: SEQUENCE rejects values that are not sequence sets'] = test =>
+    asyncWrapper(test, async test => {
+        // Sequence sets are written verbatim, so a range string that reached the
+        // compiler unvalidated would put a second command on the wire
+        for (let value of ['1\r\nZZ1 LOGOUT', '1 2', '1;2', 'ALL', '1:2)', '1\t2', Buffer.from('1\r\nZZ NOOP')]) {
+            let err = await compileError([{ type: 'SEQUENCE', value }]);
+            test.equal(err && err.code, 'InvalidSequenceSet', `${JSON.stringify(value.toString())} must be rejected`);
+        }
+    });
+
+module.exports['IMAP Compiler: SEQUENCE accepts every valid sequence-set form'] = test =>
+    asyncWrapper(test, async test => {
+        for (let value of ['1', '*', '1:*', '*:1', '1,3,5', '1:3,7,9:*', '4294967295']) {
+            const compiled = (await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'SEQUENCE', value }] })).toString();
+            test.equal(compiled, `A FETCH ${value}`);
+        }
+    });
+
+module.exports['IMAP Compiler: quoted strings use IMAP escaping, not JSON escaping'] = test =>
+    asyncWrapper(test, async test => {
+        // Only DQUOTE and backslash have escapes in the IMAP grammar - a tab must
+        // survive as a raw byte rather than becoming a literal backslash-t
+        const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'STRING', value: 'a\tb"c\\d' }] })).toString();
+        test.equal(compiled, 'A CMD "a\tb\\"c\\\\d"');
+    });
+
+module.exports['IMAP Compiler: quoted strings reject CR, LF and NUL'] = test =>
+    asyncWrapper(test, async test => {
+        for (let value of ['a\rb', 'a\nb', 'a\0b']) {
+            let err = await compileError([{ type: 'STRING', value }]);
+            test.equal(err && err.code, 'InvalidStringValue', `${JSON.stringify(value)} cannot be sent as a quoted string`);
+        }
+    });
+
+module.exports['IMAP Compiler: a mailbox name with CRLF cannot reach the wire'] = test =>
+    asyncWrapper(test, async test => {
+        // Paths travel as ATOM tokens and get quoted when they fall outside ATOM-CHAR
+        let err = await compileError([{ type: 'ATOM', value: 'INBOX\r\nZZ LOGOUT' }]);
+        test.equal(err && err.code, 'InvalidStringValue');
+    });
+
+module.exports['IMAP Compiler: response text cannot carry a line terminator'] = test =>
+    asyncWrapper(test, async test => {
+        // TEXT is written verbatim as well, so it gets the same guarantee even though
+        // only the parser produces it today
+        let err = await compileError([{ type: 'TEXT', value: 'oops\r\nZZ NOOP' }]);
+        test.equal(err && err.code, 'InvalidTextValue');
+    });
+
+module.exports['IMAP Compiler: NUMBER coerces its value instead of writing it through'] = test =>
+    asyncWrapper(test, async test => {
+        const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value: '1\r\nZZ NOOP' }] })).toString();
+        test.equal(compiled, 'A CMD 0', 'a non-numeric value must not reach the wire verbatim');
+        test.equal((await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value: '42' }] })).toString(), 'A CMD 42');
+    });
+
+module.exports['IMAP Compiler: partial range coerces its elements'] = test =>
+    asyncWrapper(test, async test => {
+        // The partial range is the last token component written verbatim, so it is
+        // coerced rather than joined as-is
+        const attributes = [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: ['0>\r\nZZ NOOP'] }];
+        const compiled = (await compiler({ tag: 'A', command: 'FETCH', attributes })).toString();
+        test.equal(compiled, 'A FETCH BODY.PEEK[]<0>');
+
+        const normal = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: [0, 1024] }] })
+        ).toString();
+        test.equal(normal, 'A FETCH BODY.PEEK[]<0.1024>');
+    });
+
+module.exports['IMAP Compiler: logging output never throws on unsendable values'] = test =>
+    asyncWrapper(test, async test => {
+        // The logging pass must survive whatever the wire pass refuses, so a rejected
+        // command can still be logged
+        const compiled = (
+            await compiler(
+                {
+                    tag: 'A',
+                    command: 'LOGIN',
+                    attributes: [{ type: 'STRING', value: 'a\r\nb' }]
+                },
+                { isLogging: true }
+            )
+        ).toString();
+        test.ok(compiled.includes('\\r\\n'), 'control characters stay escaped for the log');
+    });

package/test/imap-flow-secure-test.js

@@ -135,6 +135,62 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
     test.done();
 };
 
+module.exports['Secure: STARTTLS discards capabilities even when the OK carries a CAPABILITY code'] = async test => {
+    // A server (or a MITM rewriting the plaintext stream) may stamp [CAPABILITY ...]
+    // on the STARTTLS OK itself. That marks the capability set as freshly updated, so
+    // a discard conditioned on "an update is still pending" would keep exactly the
+    // pre-TLS list an attacker controls - the list that then chooses the AUTH
+    // mechanism and answers LOGINDISABLED. RFC 9051 6.2.1 makes the discard mandatory.
+    let server = net.createServer(rawSocket => {
+        rawSocket.on('error', () => {});
+
+        let detachPlain;
+        detachPlain = lineReader(rawSocket, line => {
+            let parts = line.split(' ');
+            let tag = parts[0];
+            let cmd = (parts[1] || '').toUpperCase();
+
+            if (cmd === 'STARTTLS') {
+                rawSocket.write(`${tag} OK [CAPABILITY ${CAPS} PRETLS-ONLY] Begin TLS\r\n`);
+                detachPlain();
+                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                tlsSocket.on('error', () => {});
+                lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
+                return;
+            }
+
+            handleLine(rawSocket, line, null, `${CAPS} STARTTLS PRETLS-ONLY`);
+        });
+
+        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
+    });
+
+    let port = await listen(server);
+    let client = new ImapFlow({
+        host: '127.0.0.1',
+        port,
+        secure: false,
+        doSTARTTLS: true,
+        servername: 'localhost',
+        tls: { rejectUnauthorized: false },
+        disableAutoIdle: true,
+        disableCompression: true,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' }
+    });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.secureConnection, 'connection upgraded to TLS');
+    test.ok(client.capabilities.has('POSTTLS-ONLY'), 'post-TLS capabilities were re-fetched');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
 // Builds the STARTTLS happy-path server used by the watchdog and cleanup tests below.
 const createStartTlsServer = () =>
     net.createServer(rawSocket => {

package/test/imap-flow-server-test.js

@@ -1310,3 +1310,39 @@ module.exports['Server: socket close triggers close handling'] = async test => {
     client.close();
     test.done();
 };
+
+module.exports['Server: an unparseable tagged completion fails the command instead of stalling'] = async test => {
+    // A tagged line the parser cannot make sense of used to be logged and dropped.
+    // currentRequest then stayed set forever, so trySend() stopped dispatching and
+    // every later command queued behind a promise that never settled.
+    let server = createServer({
+        handlers: {
+            SELECT(ctx) {
+                // A control character inside the response code is not parseable
+                ctx.write(`${ctx.tag} OK [\x01BAD-CODE] SELECT completed\r\n`);
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+
+    let selectErr = null;
+    try {
+        await client.mailboxOpen('INBOX');
+    } catch (err) {
+        selectErr = err;
+    }
+    test.ok(selectErr, 'the command whose completion could not be parsed must reject');
+
+    // The connection has to keep working: the next command still gets dispatched
+    let folders = await client.list();
+    test.ok(Array.isArray(folders) && folders.length, 'later commands still run');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};

package/test/imap-parser-test.js

@@ -1421,3 +1421,29 @@ module.exports['IMAP Parser, ATOM with <, [, ]'] = test =>
             ]
         });
     });
+
+module.exports['IMAP Parser: unbalanced bracket in a response code keeps the human-readable text'] = test =>
+    asyncWrapper(test, async test => {
+        // RFC 9051 lets a response code carry free text containing '[' but not ']'.
+        // Counting that '[' as a nested bracket loses the whole human-readable text,
+        // which is what NO/BAD error messages are built from.
+        const parsed = await parser('A1 NO [XFOO see bar[baz] mailbox is busy');
+        const text = (parsed.attributes || [])
+            .filter(entry => entry && entry.type === 'TEXT')
+            .map(entry => entry.value)
+            .join('');
+        test.equal(text, 'mailbox is busy');
+    });
+
+module.exports['IMAP Parser: balanced brackets inside a response code are still tolerated'] = test =>
+    asyncWrapper(test, async test => {
+        // Servers do put bracketed values inside a code, so a plain first-']' scan
+        // would cut the code in half
+        const parsed = await parser('* OK [PERMANENTFLAGS ([css3-page] \\*)] Flags permitted.');
+        const text = (parsed.attributes || [])
+            .filter(entry => entry && entry.type === 'TEXT')
+            .map(entry => entry.value)
+            .join('');
+        test.equal(text, 'Flags permitted.');
+        test.equal(parsed.attributes[0].section[0].value, 'PERMANENTFLAGS');
+    });

package/test/imap-stream-edge-cases-test.js

@@ -456,3 +456,51 @@ module.exports['ImapStream: _destroy drains pending input queue callbacks'] = te
         test.done();
     });
 };
+
+module.exports['Literal marker scan stays linear on a long digit run'] = test => {
+    // A backwards scan that accumulated digits one at a time cost O(n^2), so a few
+    // hundred KB of digits blocked the event loop for seconds before the size was
+    // even known - all inside the default line-length budget
+    const stream = new ImapStream({ cid: 'test' });
+    stream.on('error', () => {});
+    stream.resume();
+
+    const line = Buffer.concat([Buffer.from('* OK {'), Buffer.from('9'.repeat(200000)), Buffer.from('}\r\n')]);
+
+    const started = process.hrtime.bigint();
+    stream.checkLiteralMarker(line);
+    const elapsedMs = Number(process.hrtime.bigint() - started) / 1e6;
+
+    test.ok(elapsedMs < 250, `scan should stay cheap, took ${elapsedMs.toFixed(1)}ms`);
+    test.done();
+};
+
+module.exports['Literal marker rejects an oversized digit run without parsing it'] = test => {
+    const stream = new ImapStream({ cid: 'test' });
+    stream.on('error', () => {});
+    stream.resume();
+
+    // Longer than any number64 can be, so it cannot be a valid marker
+    const line = Buffer.concat([Buffer.from('* OK {'), Buffer.from('1'.repeat(40)), Buffer.from('}\r\n')]);
+
+    test.equal(stream.checkLiteralMarker(line), false, 'an impossible size must not start literal mode');
+    test.done();
+};
+
+module.exports['Literal marker still accepts sizes at the digit-length bound'] = test => {
+    const stream = new ImapStream({ cid: 'test', maxLiteralSize: Number.MAX_SAFE_INTEGER });
+    stream.on('error', () => {});
+    stream.resume();
+
+    // 19 digits is the widest a number64 gets, so it must still be recognized
+    const line = Buffer.from(`* OK {${'9'.repeat(19)}}\r\n`);
+
+    test.equal(stream.checkLiteralMarker(line), false, 'a size beyond the configured maximum fails the stream rather than parsing');
+
+    const ok = new ImapStream({ cid: 'test' });
+    ok.on('error', () => {});
+    ok.resume();
+    test.equal(ok.checkLiteralMarker(Buffer.from('* OK {1024}\r\n')), true);
+    test.equal(ok.literalWaiting, 1024);
+    test.done();
+};

package/test/integration/rev2-live-test.js

@@ -150,7 +150,12 @@ module.exports['Live rev2: statusQuery is answered inline via LIST-STATUS'] = as
 
         const folders = await client.list({ statusQuery: { messages: true, unseen: true } });
 
-        test.ok(clientSent(logs, 'STATUS'), 'LIST should carry RETURN (STATUS ...)');
+        // Pin the inline LIST-STATUS behavior: the STATUS request must ride on the
+        // LIST command itself, and no standalone STATUS command may be issued -
+        // a plain substring check would also pass on the fallback path
+        const listLine = wireLines(logs).find(entry => entry.src === 'c' && /^\S+ LIST /.test(entry.msg));
+        test.ok(listLine && listLine.msg.includes('RETURN') && listLine.msg.includes('STATUS'), 'LIST should carry RETURN (STATUS ...)');
+        test.ok(!wireLines(logs).some(entry => entry.src === 'c' && /^\S+ STATUS /.test(entry.msg)), 'no standalone STATUS command should be needed');
         const inbox = folders.find(folder => folder.path === 'INBOX');
         test.equal(inbox.status.messages, 1, 'inline STATUS should report the appended message');
     } finally {
@@ -207,6 +212,26 @@ module.exports['Live rev2: returnOptions search is answered via a real ESEARCH r
     test.done();
 };
 
+module.exports['Live rev2: MODSEQ search criterion surfaces modseq from the ESEARCH response'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        // RFC 7162: a MODSEQ criterion on a CONDSTORE session makes the server
+        // append MODSEQ to the ESEARCH response
+        const result = await client.search({ modseq: 1 }, { returnOptions: ['ALL', 'COUNT'] });
+
+        test.equal(result.count, 2);
+        test.equal(result.all, '1:2');
+        test.ok(typeof result.modseq === 'bigint' && result.modseq > 0n, 'modseq should surface as a positive BigInt');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
 module.exports['Live rev2: STATUS reports SIZE and DELETED'] = async test => {
     const logs = [];
     const client = await connectClient(null, logs);
@@ -253,8 +278,17 @@ module.exports['Live rev2: SELECT response carries an untagged LIST and re-selec
         test.equal(mailbox.path, 'INBOX');
 
         // RFC 9051 6.3.1: the SELECT response includes an untagged LIST for the
-        // selected mailbox - the client must consume it without issue
-        test.ok(serverSentUntagged(logs, 'LIST'), 'rev2 SELECT should include an untagged LIST response');
+        // selected mailbox - the client must consume it without issue. Scoped to
+        // the SELECT exchange itself: mailboxOpen() also issues its own LIST
+        // command first, whose untagged replies would satisfy a global check
+        // even if the SELECT response omitted the LIST
+        const lines = wireLines(logs);
+        const selectIdx = lines.findIndex(entry => entry.src === 'c' && /^\S+ SELECT /.test(entry.msg));
+        test.ok(selectIdx >= 0, 'SELECT command should be on the wire');
+        const selectTag = lines[selectIdx].msg.split(' ')[0];
+        const doneIdx = lines.findIndex((entry, i) => i > selectIdx && entry.src === 's' && entry.msg.startsWith(`${selectTag} `));
+        const listInSelect = lines.some((entry, i) => i > selectIdx && i < doneIdx && entry.src === 's' && /^\* LIST( |$)/.test(entry.msg));
+        test.ok(listInSelect, 'rev2 SELECT response should include an untagged LIST response');
 
         // switching mailboxes must produce a CLOSED response code for the old one
         await client.mailboxOpen('Closer');

package/test/search-test.js

@@ -212,16 +212,45 @@ module.exports['ESEARCH: command path returns false on exec error'] = test => {
 };
 
 module.exports['ESEARCH: parseEsearchResponse ignores unknown keywords'] = test => {
-    // Dovecot with CONDSTORE may append MODSEQ to ESEARCH responses
+    // Unknown result keywords must be skipped with their value so the
+    // key/value stream stays aligned for the entries that follow
+    const attrs = [
+        { type: 'ATOM', value: 'RELEVANCY' },
+        { type: 'ATOM', value: '87' },
+        { type: 'ATOM', value: 'COUNT' },
+        { type: 'ATOM', value: '5' }
+    ];
+    const result = parseEsearchResponse(attrs);
+    test.equal(result.count, 5);
+    test.equal(result.relevancy, undefined, 'unknown keys should not appear in result');
+    test.done();
+};
+
+module.exports['ESEARCH: parseEsearchResponse parses MODSEQ as BigInt'] = test => {
+    // RFC 7162: CONDSTORE sessions append MODSEQ to ESEARCH responses when the
+    // search used a MODSEQ criterion
     const attrs = [
         { type: 'ATOM', value: 'COUNT' },
         { type: 'ATOM', value: '5' },
         { type: 'ATOM', value: 'MODSEQ' },
-        { type: 'ATOM', value: '12345' }
+        { type: 'ATOM', value: '9007199254740993' }
     ];
     const result = parseEsearchResponse(attrs);
     test.equal(result.count, 5);
-    test.equal(result.modseq, undefined, 'unknown keys should not appear in result');
+    test.strictEqual(result.modseq, 9007199254740993n, 'modseq should be an exact BigInt');
+    test.done();
+};
+
+module.exports['ESEARCH: parseEsearchResponse drops non-numeric MODSEQ'] = test => {
+    const attrs = [
+        { type: 'ATOM', value: 'MODSEQ' },
+        { type: 'ATOM', value: 'bogus' },
+        { type: 'ATOM', value: 'COUNT' },
+        { type: 'ATOM', value: '3' }
+    ];
+    const result = parseEsearchResponse(attrs);
+    test.equal(result.modseq, undefined, 'invalid modseq must be dropped');
+    test.equal(result.count, 3, 'stream must stay aligned after a dropped value');
     test.done();
 };
 

package/test/tools-test.js

@@ -234,8 +234,23 @@ module.exports['Tools: hasCapability with advertised token'] = test => {
 
 module.exports['Tools: hasCapability folds extensions into active rev2'] = test => {
     let connection = createMockConnection({ capabilities: [['IMAP4rev2', true]] });
-    // RFC 9051 Appendix E folds these into base IMAP4rev2
-    for (let capability of ['UIDPLUS', 'MOVE', 'NAMESPACE', 'ESEARCH', 'LITERAL-', 'LIST-EXTENDED', 'LIST-STATUS', 'SPECIAL-USE', 'ENABLE']) {
+    // RFC 9051 Appendix E folds these into base IMAP4rev2 - the complete set
+    for (let capability of [
+        'ENABLE',
+        'ESEARCH',
+        'IDLE',
+        'LIST-EXTENDED',
+        'LIST-STATUS',
+        'LITERAL-',
+        'MOVE',
+        'NAMESPACE',
+        'SASL-IR',
+        'SEARCHRES',
+        'SPECIAL-USE',
+        'STATUS=SIZE',
+        'UIDPLUS',
+        'UNSELECT'
+    ]) {
         test.equal(tools.hasCapability(connection, capability), true, `${capability} should be folded into rev2`);
     }
     // BINARY is intentionally not folded
@@ -336,6 +351,17 @@ module.exports['Tools: getErrorText with valid response'] = async test => {
     test.done();
 };
 
+module.exports['Tools: getErrorText survives a response that cannot be re-encoded'] = async test => {
+    // The parser tolerates stray bytes inside an OK/NO/BAD atom, and those have no
+    // valid IMAP string encoding. The error text is diagnostic, so it must still be
+    // produced rather than replacing the server's error with an encoding failure.
+    let response = await parser(Buffer.from('A1 NO [SERVERBUG\x00X] it failed', 'binary'));
+    let result = await tools.getErrorText(response);
+    test.ok(typeof result === 'string', 'error text should still be produced');
+    test.ok(result.includes('it failed'), 'the human-readable part must survive');
+    test.done();
+};
+
 // ============================================
 // getFlagColor tests
 // ============================================