imapflow 1.6.4 → 1.6.5

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.4"
+    ".": "1.6.5"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.6.5](https://github.com/postalsys/imapflow/compare/v1.6.4...v1.6.5) (2026-07-29)
+
+
+### Bug Fixes
+
+* resolve regressions from the rev2 hardening commit and harden further ([0739df9](https://github.com/postalsys/imapflow/commit/0739df93709d2c7d572e977c2b37b6d219e69e30))
+
 ## [1.6.4](https://github.com/postalsys/imapflow/compare/v1.6.3...v1.6.4) (2026-07-29)
 
 

package/lib/commands/compress.js

@@ -19,26 +19,37 @@ module.exports = async connection => {
     let response;
     try {
         response = await connection.exec('COMPRESS', [{ type: 'ATOM', value: 'DEFLATE' }]);
-        // Everything after the tagged OK is already deflate-framed (RFC 4978 section 4).
-        // The socket stays piped into the plaintext parser until this call returns, so
-        // bytes that arrived in the same chunk as the OK have been consumed as cleartext
-        // and are missing from the head of the deflate stream - the inflater would then
-        // fail and take the connection with it. Rare (it needs the server to write again
-        // before we re-pipe), and staying uncompressed is a cheaper outcome than a dead
-        // connection, so decline the upgrade instead.
-        // This only covers the bytes the parser had already buffered when the OK was
-        // handled. Closing the remaining window, and keeping compression rather than
-        // dropping it, needs the stream to hand back its unconsumed tail on unpipe so
-        // the transport can feed it into the inflater - not something a command module
-        // can reach from here.
-        response.next();
-        if (response.hasTrailingData) {
-            connection.log.warn({ msg: 'Server sent data immediately after the COMPRESS response, skipping compression', cid: connection.id });
-            return false;
-        }
-        return true;
     } catch (err) {
+        // The server declined (NO/BAD): nothing switched, staying uncompressed is safe.
         connection.log.warn({ err, cid: connection.id });
         return false;
     }
+
+    // Everything after the tagged OK is already deflate-framed (RFC 4978 section 4) -
+    // the server switches at the OK, so declining the upgrade at this point is not a
+    // protocol option. The socket stays piped into the plaintext parser until the
+    // transport swaps in the inflater, so bytes that arrived in the same chunk as the
+    // OK have been consumed as cleartext and are missing from the head of the deflate
+    // stream: the session is unrecoverable in both directions. Fail it immediately
+    // (the same way STARTTLS treats post-OK trailing data) instead of letting it die
+    // slowly on garbage. Closing this window without failing needs the stream to hand
+    // back its unconsumed tail on unpipe so the transport can feed it into the
+    // inflater - not something a command module can reach from here.
+    if (response.hasTrailingData) {
+        let error = new Error('Server sent data between the COMPRESS response and the compression layer switch');
+        error.code = 'COMPRESS_TRAILING_DATA';
+        connection.log.error({ err: error, cid: connection.id });
+        // Schedule the close before releasing parser backpressure, so the buffered
+        // deflate-framed bytes cannot settle anything before teardown begins. This is
+        // why the decision lives here rather than at the connection layer the way the
+        // STARTTLS guard does (starttls.js records a flag, upgradeToSTARTTLS decides):
+        // only the command module holds the response before its backpressure release,
+        // so only it can order teardown ahead of that release.
+        connection.closeAfter();
+        response.next();
+        throw error;
+    }
+
+    response.next();
+    return true;
 };

package/lib/handler/imap-compiler.js

@@ -4,11 +4,27 @@
 
 const imapFormalSyntax = require('./imap-formal-syntax');
 
-// A sequence-set as defined by the RFC 9051 grammar: comma-separated numbers and
-// ranges, where "*" stands for the largest number in use. Digit strings are not
+// A single element of a sequence-set as defined by the RFC 9051 grammar: a number
+// or a range, where "*" stands for the largest number in use. Digit strings are not
 // range-checked here (a server rejects "0" or an overlong number on its own); the
 // point of the check is that nothing outside this alphabet can reach the wire.
-const SEQUENCE_SET = /^(\d+|\*)(:(\d+|\*))?(,(\d+|\*)(:(\d+|\*))?)*$/;
+const SEQ_RANGE = /^(\d+|\*)(:(\d+|\*))?$/;
+
+// Validates a full sequence-set: comma-separated SEQ_RANGE elements, or "$"
+// (RFC 5182 SEARCHRES), which references the previous SEARCH result and is only
+// valid as the entire set. Split into per-element tests on purpose - a whole-set
+// regex with an unbounded repeat group overflows the regex engine's backtrack
+// stack with an uncoded RangeError on valid sets in the million-element range,
+// while the per-element regex is bounded.
+const isValidSequenceSet = value => value === '$' || value.split(',').every(part => SEQ_RANGE.test(part));
+
+// Numeric tokens may only put the digit alphabet on the wire. Anything that does
+// not round to a bounded non-negative integer (NaN, Infinity, negatives, unsafe
+// magnitudes) degrades to 0 - the fallback the NaN coercion has always used.
+const safeNumber = value => {
+    let num = Math.round(Number(value));
+    return Number.isSafeInteger(num) && num >= 0 ? num : 0;
+};
 
 // Characters that cannot appear in an IMAP quoted string: CR and LF terminate a
 // command line, and NUL is outside the CHAR production entirely. A value carrying
@@ -37,33 +53,6 @@ const quoteString = value => {
     return '"' + value.replace(/["\\]/g, char => '\\' + char) + '"';
 };
 
-/**
- * Formats a response entry into a Buffer.
- *
- * @param {string|number|Buffer} entry - The value to convert to a Buffer.
- * @param {boolean} [returnEmpty] - If true, returns null instead of an empty Buffer when the entry is not a recognized type.
- * @returns {Buffer|null} The entry as a Buffer, or null if returnEmpty is true and the entry is not a recognized type.
- */
-const formatRespEntry = (entry, returnEmpty) => {
-    if (typeof entry === 'string') {
-        return Buffer.from(entry);
-    }
-
-    if (typeof entry === 'number') {
-        return Buffer.from(entry.toString());
-    }
-
-    if (Buffer.isBuffer(entry)) {
-        return entry;
-    }
-
-    if (returnEmpty) {
-        return null;
-    }
-
-    return Buffer.alloc(0);
-};
-
 /**
  * Compiles an input object into a sequence of Buffers representing an IMAP protocol response string.
  * Handles various node types including literals, strings, atoms, sections, sequences, and nested lists.
@@ -83,7 +72,43 @@ module.exports = async (response, options) => {
     let { asArray, isLogging, literalPlus, literalMinus } = options || {};
     const respParts = [];
 
-    let resp = [].concat(formatRespEntry(response.tag, true) || []).concat(response.command ? formatRespEntry(' ' + response.command) : []);
+    // Formats an entry (string, number or Buffer) into the Buffer that is written to
+    // the wire, and is the choke point every emission passes through: a line
+    // terminator ends an IMAP command, so no token - the tag and command name
+    // included - may put one on the wire. The literal size marker and literal data
+    // are the only emissions where CRLF is legitimate; those call sites opt out with
+    // `raw`. Never enforced when logging: re-encoding an incoming server response for
+    // the log or for error text must not throw, whatever the server sent. With
+    // `returnEmpty`, an unrecognized entry type yields null instead of an empty
+    // Buffer.
+    const emitEntry = (entry, opts) => {
+        let { returnEmpty, raw } = opts || {};
+        if (!raw && !isLogging && (typeof entry === 'string' || Buffer.isBuffer(entry)) && CRLF.test(entry.toString('latin1'))) {
+            let error = new Error('Line terminator in IMAP token');
+            error.code = 'InvalidTokenValue';
+            throw error;
+        }
+
+        if (typeof entry === 'string') {
+            return Buffer.from(entry);
+        }
+
+        if (typeof entry === 'number') {
+            return Buffer.from(entry.toString());
+        }
+
+        if (Buffer.isBuffer(entry)) {
+            return entry;
+        }
+
+        if (returnEmpty) {
+            return null;
+        }
+
+        return Buffer.alloc(0);
+    };
+
+    let resp = [].concat(emitEntry(response.tag, { returnEmpty: true }) || []).concat(response.command ? emitEntry(' ' + response.command) : []);
     let val;
     let lastType;
 
@@ -108,7 +133,7 @@ module.exports = async (response, options) => {
         // adjacent lists).
         if (lastType === 'LITERAL' || (!['(', '<', '['].includes(lastRespByte) && resp.length)) {
             if (!options.subArray) {
-                resp.push(formatRespEntry(' '));
+                resp.push(emitEntry(' '));
             }
         }
 
@@ -119,7 +144,7 @@ module.exports = async (response, options) => {
 
         if (Array.isArray(node)) {
             lastType = 'LIST';
-            resp.push(formatRespEntry('('));
+            resp.push(emitEntry('('));
 
             // check if we need to skip separator WS between two arrays
             let subArray = node.length > 1 && Array.isArray(node[0]);
@@ -131,40 +156,40 @@ module.exports = async (response, options) => {
                 await walk(child, { subArray });
             }
 
-            resp.push(formatRespEntry(')'));
+            resp.push(emitEntry(')'));
             return;
         }
 
         if (!node && typeof node !== 'string' && typeof node !== 'number' && !Buffer.isBuffer(node)) {
-            resp.push(formatRespEntry('NIL'));
+            resp.push(emitEntry('NIL'));
             return;
         }
 
         if (typeof node === 'string' || Buffer.isBuffer(node)) {
             if (isLogging && node.length > 100) {
-                resp.push(formatRespEntry('"(* ' + node.length + 'B string *)"'));
+                resp.push(emitEntry('"(* ' + node.length + 'B string *)"'));
             } else {
-                resp.push(formatRespEntry(isLogging ? JSON.stringify(node.toString()) : quoteString(node.toString())));
+                resp.push(emitEntry(isLogging ? JSON.stringify(node.toString()) : quoteString(node.toString())));
             }
             return;
         }
 
         if (typeof node === 'number') {
-            resp.push(formatRespEntry(Math.round(node) || 0)); // Only integers allowed
+            resp.push(emitEntry(safeNumber(node))); // Only bounded non-negative integers allowed
             return;
         }
 
         lastType = node.type;
 
         if (isLogging && node.sensitive) {
-            resp.push(formatRespEntry('"(* value hidden *)"'));
+            resp.push(emitEntry('"(* value hidden *)"'));
             return;
         }
 
         switch (node.type.toUpperCase()) {
             case 'LITERAL':
                 if (isLogging) {
-                    resp.push(formatRespEntry('"(* ' + node.value.length + 'B literal *)"'));
+                    resp.push(emitEntry('"(* ' + node.value.length + 'B literal *)"'));
                 } else {
                     // The literal size marker counts octets - string values are written as
                     // UTF-8, so their UTF-16 .length would undercount multi-byte characters
@@ -180,29 +205,29 @@ module.exports = async (response, options) => {
                     let canAppend = !asArray || usePlus;
 
                     // Emit the literal header: optional '~' prefix for literal8, then {size[+]}\r\n
-                    resp.push(formatRespEntry(`${node.isLiteral8 ? '~' : ''}{${literalLength}${usePlus ? '+' : ''}}\r\n`));
+                    resp.push(emitEntry(`${node.isLiteral8 ? '~' : ''}{${literalLength}${usePlus ? '+' : ''}}\r\n`, { raw: true }));
 
                     if (canAppend) {
                         // Literal data follows immediately in the same buffer segment
                         if (node.value && node.value.length) {
-                            resp.push(formatRespEntry(node.value));
+                            resp.push(emitEntry(node.value, { raw: true }));
                         }
                     } else {
                         // For synchronizing literals in asArray mode, split output into separate
                         // parts. The caller must send each part and wait for a continuation
                         // response from the server before sending the next.
                         respParts.push(resp);
-                        resp = [].concat(formatRespEntry(node.value, true) || []);
+                        resp = [].concat(emitEntry(node.value, { returnEmpty: true, raw: true }) || []);
                     }
                 }
                 break;
 
             case 'STRING':
                 if (isLogging && node.value.length > 100) {
-                    resp.push(formatRespEntry('"(* ' + node.value.length + 'B string *)"'));
+                    resp.push(emitEntry('"(* ' + node.value.length + 'B string *)"'));
                 } else {
                     val = (node.value || '').toString();
-                    resp.push(formatRespEntry(isLogging ? JSON.stringify(val) : quoteString(val)));
+                    resp.push(emitEntry(isLogging ? JSON.stringify(val) : quoteString(val)));
                 }
                 break;
 
@@ -210,34 +235,39 @@ module.exports = async (response, options) => {
                 // Sequence sets are written verbatim - they are the one token type with
                 // no quoting to fall back on. Callers build them from user-supplied
                 // ranges, so validate here, at the single point every outgoing sequence
-                // set passes through, rather than trusting each command module. Values
-                // the parser produced for a server response are already within this
-                // alphabet, so re-compiling a response (logging, error text) is unaffected.
-                if (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value)) {
+                // set passes through, rather than trusting each command module. Skipped
+                // when logging: the incoming token parser accepts sequence-shaped tokens
+                // this strict grammar rejects (an ESEARCH set like "1:2:3", a folder
+                // name like "12:30:00"), and re-compiling a server response for the log
+                // or for error text must never throw.
+                if (!isLogging && (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value))) {
                     val = node.value.toString();
-                    if (val && !SEQUENCE_SET.test(val)) {
+                    if (val && !isValidSequenceSet(val)) {
                         let error = new Error('Invalid sequence set value');
                         error.code = 'InvalidSequenceSet';
                         throw error;
                     }
                 }
                 if (node.value) {
-                    resp.push(formatRespEntry(node.value));
+                    // raw: the validated alphabet cannot contain a line terminator, and
+                    // re-scanning a potentially multi-megabyte set in the choke point
+                    // would double the cost of exactly the sets this branch exists for
+                    resp.push(emitEntry(node.value, { raw: true }));
                 }
                 break;
 
             case 'TEXT':
                 // Response text is written verbatim. Only the parser produces it today, for
                 // incoming lines, so this is a re-encoding path rather than a command-building
-                // one - but the choke point is only worth anything if it holds for every token
-                // type, so a line terminator is refused here too.
+                // one. The emitEntry choke point would refuse a line terminator here too;
+                // this check runs first only to raise the more specific InvalidTextValue code.
                 if (node.value) {
                     if (!isLogging && CRLF.test(node.value.toString())) {
                         let error = new Error('Line terminator in IMAP text value');
                         error.code = 'InvalidTextValue';
                         throw error;
                     }
-                    resp.push(formatRespEntry(node.value));
+                    resp.push(emitEntry(node.value));
                 }
                 break;
 
@@ -245,7 +275,7 @@ module.exports = async (response, options) => {
                 // Coerced rather than written through: formatRespEntry passes a string or
                 // Buffer straight to the wire, so a numeric token carrying a string value
                 // would be another verbatim channel
-                resp.push(formatRespEntry(Math.round(Number(node.value)) || 0));
+                resp.push(emitEntry(safeNumber(node.value)));
                 break;
 
             case 'ATOM':
@@ -255,24 +285,25 @@ module.exports = async (response, options) => {
                 if (!node.section || val) {
                     // Verify the value contains only valid ATOM-CHAR characters.
                     // Strip a leading backslash before checking (system flags like \Seen start with '\').
-                    // If any character fails verification, quote-escape the entire value with JSON.stringify.
+                    // If any character fails verification, fall back to an IMAP quoted string
+                    // (JSON.stringify is used only for log output, where values are display-escaped).
                     if (node.value === '' || imapFormalSyntax.verify(val.charAt(0) === '\\' ? val.substr(1) : val, imapFormalSyntax['ATOM-CHAR']()) >= 0) {
                         val = isLogging ? JSON.stringify(val) : quoteString(val);
                     }
 
-                    resp.push(formatRespEntry(val));
+                    resp.push(emitEntry(val));
                 }
 
                 // Section bracket handling: emit [section-contents] after the ATOM value
                 // e.g., BODY[HEADER.FIELDS (Subject)] or BODY[1.MIME]
                 if (node.section) {
-                    resp.push(formatRespEntry('['));
+                    resp.push(emitEntry('['));
 
                     for (let child of node.section) {
                         await walk(child);
                     }
 
-                    resp.push(formatRespEntry(']'));
+                    resp.push(emitEntry(']'));
                 }
                 // Partial range: emit <origin.length> after the section brackets. Coerced
                 // rather than joined as-is: this is the last token component written
@@ -280,7 +311,7 @@ module.exports = async (response, options) => {
                 // all of them. Every producer already passes numbers, so nothing changes
                 // for them.
                 if (node.partial) {
-                    resp.push(formatRespEntry(`<${node.partial.map(entry => Number(entry) || 0).join('.')}>`));
+                    resp.push(emitEntry(`<${node.partial.map(safeNumber).join('.')}>`));
                 }
                 break;
         }

package/lib/handler/imap-parser.js

@@ -81,6 +81,13 @@ module.exports = async (command, options) => {
         if (err.code === 'ParserErrorExchange' && err.parserContext && err.parserContext.value) {
             return err.parserContext.value;
         }
+        if (response.tag) {
+            // The tag had already been parsed when the rest of the line failed. Expose it
+            // so the connection can settle the command this line was addressed to - unlike
+            // re-deriving the tag from the raw bytes, this inherits the leading-NUL
+            // workaround above.
+            err.parsedTag = response.tag;
+        }
         throw err;
     }
 

package/lib/handler/imap-stream.js

@@ -166,23 +166,35 @@ class ImapStream extends Transform {
 
         // Scan backwards through the line to find an IMAP literal marker: {size}\r\n
         // The format is: '{' followed by one or more ASCII digits followed by '}'.
-        // Only the digit run's bounds are tracked, and the run is capped: the size is
-        // a number64 at most, so anything longer cannot be a valid marker. Collecting
-        // the digits into a growing array instead would make a line of n digits cost
-        // O(n^2), letting a few hundred KB of digits block the event loop for seconds
-        // before the size is even known - well inside the default line-length cap.
-        const MAX_SIZE_DIGITS = 19;
+        // Only the digit run's bounds are tracked - a single linear pass, unlike
+        // collecting digits into a growing array, which would make a line of n digits
+        // cost O(n^2). The run length is deliberately not capped: the RFC "number"
+        // production permits leading zeros, so a long digit run can still denote a
+        // small, valid size, and treating the marker as an ordinary line instead
+        // would feed the announced literal body to the line parser and desynchronize
+        // the session.
         let digitsEnd = pos;
         for (; pos >= 0; pos--) {
             let c = line[pos];
             if (c >= NUM_0 && c <= NUM_9) {
-                if (digitsEnd - pos >= MAX_SIZE_DIGITS) {
-                    return false;
-                }
                 continue;
             }
             if (c === CURLY_OPEN && pos < digitsEnd) {
-                const literalSize = Number(line.toString('latin1', pos + 1, digitsEnd + 1));
+                // Skip leading zeros so only the significant digits are converted: a
+                // marker padded with megabytes of zeros must not cost a string
+                // allocation and Number() parse of the whole run.
+                let digitsStart = pos + 1;
+                while (digitsStart < digitsEnd && line[digitsStart] === NUM_0) {
+                    digitsStart++;
+                }
+
+                // More significant digits than any number64 has cannot fit any
+                // permissible maxLiteralSize; fail closed without materializing them
+                if (digitsEnd + 1 - digitsStart > 19) {
+                    return this.failStream(createLiteralTooLargeError(Infinity, this.maxLiteralSize, 'the widest permissible literal size (19 digits)'));
+                }
+
+                const literalSize = Number(line.toString('latin1', digitsStart, digitsEnd + 1));
 
                 if (literalSize > this.maxLiteralSize) {
                     return this.failStream(createLiteralTooLargeError(literalSize, this.maxLiteralSize));

package/lib/imap-flow.js

@@ -643,22 +643,40 @@ class ImapFlow extends EventEmitter {
         }
 
         if (typeof options.onSend === 'function') {
-            options.onSend();
+            // The command is already on the wire, so a throwing onSend callback must not
+            // reach trySend()'s catch - that would reject the request and dispatch the
+            // next command into the server's pending state for this one.
+            try {
+                options.onSend();
+            } catch (err) {
+                this.log.warn({ err, cid: this.id });
+            }
         }
     }
 
     async trySend() {
-        if (this.currentRequest || !this.requestQueue.length) {
-            return;
-        }
-        this.currentRequest = this.requestQueue.shift();
+        while (!this.currentRequest && this.requestQueue.length) {
+            this.currentRequest = this.requestQueue.shift();
 
-        await this.send({
-            tag: this.currentRequest.tag,
-            command: this.currentRequest.command,
-            attributes: this.currentRequest.attributes,
-            options: this.currentRequest.options
-        });
+            try {
+                await this.send({
+                    tag: this.currentRequest.tag,
+                    command: this.currentRequest.command,
+                    attributes: this.currentRequest.attributes,
+                    options: this.currentRequest.options
+                });
+                return;
+            } catch (err) {
+                // A failure here (most likely the compiler refusing an invalid
+                // user-supplied value) belongs to the command that was being dispatched.
+                // Without this the shifted request would stay currentRequest forever:
+                // nothing reached the wire, so no tagged response ever clears it, and
+                // every later command would queue behind it until the socket timeout.
+                // Reject the failed command and keep draining the queue.
+                this.commandParts = [];
+                this.rejectCurrentRequest(err);
+            }
+        }
     }
 
     exec(command, attributes, options) {
@@ -685,10 +703,10 @@ class ImapFlow extends EventEmitter {
         let promise = new Promise((resolve, reject) => {
             this.requestTagMap.set(tag, { command, attributes, options, resolve, reject });
             this.requestQueue.push({ tag, command, attributes, options });
-            this.trySend().catch(err => {
-                this.requestTagMap.delete(tag);
-                reject(err);
-            });
+            // trySend() settles dispatch failures itself, by rejecting the affected
+            // command through requestTagMap; this catch exists only so a throw from the
+            // dispatch machinery itself can never surface as a floating rejection.
+            this.trySend().catch(err => this.log.warn({ err, cid: this.id }));
         });
 
         // Prevent unhandled promise rejection if close() rejects this request
@@ -848,8 +866,17 @@ class ImapFlow extends EventEmitter {
             return;
         }
 
-        let tag = payload.toString('latin1', 0, 64).match(/^(\S+)/);
-        if (!tag || tag[1] !== this.currentRequest.tag) {
+        // Prefer the tag the parser had already extracted before it failed - it went
+        // through the same leading-NUL workaround as every parsed response. Fall back
+        // to the raw bytes for lines whose tag itself was unparseable: skip the NUL
+        // padding buggy servers prepend and stop at the first byte a tag cannot contain.
+        let tag = parserError && parserError.parsedTag;
+        if (!tag) {
+            // eslint-disable-next-line no-control-regex
+            let match = payload.toString('latin1', 0, 64).match(/^\0*([^\s\x00-\x1f\x7f]+)/);
+            tag = match && match[1];
+        }
+        if (!tag || tag !== this.currentRequest.tag) {
             return;
         }
 
@@ -873,20 +900,6 @@ class ImapFlow extends EventEmitter {
 
         try {
             parsed = await parser(data.payload, { literals: data.literals });
-            if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
-                let payload = { response: parsed.command };
-
-                if (
-                    parsed.attributes &&
-                    parsed.attributes[0] &&
-                    parsed.attributes[0].section &&
-                    parsed.attributes[0].section[0] &&
-                    parsed.attributes[0].section[0].type === 'ATOM'
-                ) {
-                    payload.code = parsed.attributes[0].section[0].value;
-                }
-                this.emit('response', payload);
-            }
         } catch (err) {
             // can not make sense of this
             this.log.error({ src: 's', msg: data.payload.toString(), err, cid: this.id });
@@ -901,6 +914,28 @@ class ImapFlow extends EventEmitter {
             return true;
         }
 
+        if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
+            let payload = { response: parsed.command };
+
+            if (
+                parsed.attributes &&
+                parsed.attributes[0] &&
+                parsed.attributes[0].section &&
+                parsed.attributes[0].section[0] &&
+                parsed.attributes[0].section[0].type === 'ATOM'
+            ) {
+                payload.code = parsed.attributes[0].section[0].value;
+            }
+            // Outside the parse try/catch on purpose: a throwing user 'response' listener
+            // is not a parse failure and must not settle the in-flight command or fail the
+            // connection - the same contract untagged handlers get.
+            try {
+                this.emit('response', payload);
+            } catch (err) {
+                this.log.warn({ err, cid: this.id });
+            }
+        }
+
         let logCompiled = await compiler(parsed, {
             isLogging: true
         });
@@ -1672,8 +1707,7 @@ class ImapFlow extends EventEmitter {
             // STARTTLS OK itself clears expectCapabilityUpdate, so keying the discard
             // on that flag would keep exactly the pre-TLS list an attacker controls -
             // the list that then picks the AUTH mechanism and answers LOGINDISABLED.
-            this.capabilities.clear();
-            this.authCapabilities.clear();
+            this.clearCapabilities();
             await this.run('CAPABILITY');
         }
 
@@ -1818,6 +1852,17 @@ class ImapFlow extends EventEmitter {
         this.state = this.states.LOGOUT;
     }
 
+    // Drops every capability-derived field together - the counterpart of
+    // updateCapabilitiesFromRaw() below, which sets them together. rawCapabilities is
+    // public surface external consumers read, so a discard (RFC 9051 6.2.1 requires
+    // one after STARTTLS) that missed it would leave the stale list visible if the
+    // re-fetch fails.
+    clearCapabilities() {
+        this.capabilities.clear();
+        this.authCapabilities.clear();
+        this.rawCapabilities = null;
+    }
+
     updateCapabilitiesFromRaw(rawCapabilities) {
         this.rawCapabilities = rawCapabilities;
         this.capabilities = updateCapabilities(rawCapabilities);