imapflow 1.6.4 → 1.6.6

package/lib/commands/status-fields.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const { parseBigIntValue, parseUintValue, MAX_UINT32_DIGITS } = require('../tools.js');
+
+// STATUS data items (RFC 3501 section 6.3.10, RFC 7162 for HIGHESTMODSEQ, RFC 9051 for SIZE
+// and DELETED) mapped to the property name each one is exposed under, together with the
+// parser that turns the raw response token into a usable value. Shared by the STATUS command
+// and by the inline STATUS responses of LIST-STATUS (RFC 5819) so the two cannot drift apart.
+//
+// Every parser rejects anything that is not a bounded decimal digit run, returning false.
+// These values are server-controlled and several of them are written straight into the live
+// mailbox state, where a NaN or a value coerced to Infinity corrupts every later range
+// computation. A plain isNaN() test is not enough: it passes '1e5', ' 12 ' and 'Infinity',
+// and BigInt() throws on all three, aborting the walk over the remaining fields.
+const uint32 = value => parseUintValue(value, MAX_UINT32_DIGITS);
+
+const STATUS_FIELDS = {
+    MESSAGES: { key: 'messages', parser: uint32 },
+    RECENT: { key: 'recent', parser: uint32 },
+    UIDNEXT: { key: 'uidNext', parser: uint32 },
+    // Nominally 32-bit, but stored as a BigInt precisely so a server that exceeds that still
+    // round-trips, so the wider bound applies
+    UIDVALIDITY: { key: 'uidValidity', parser: value => parseBigIntValue(value) },
+    UNSEEN: { key: 'unseen', parser: uint32 },
+    HIGHESTMODSEQ: { key: 'highestModseq', parser: value => parseBigIntValue(value) },
+    // IMAP4rev2 additions (RFC 9051): total mailbox size in octets (number64, exact as a JS
+    // number up to 2^53-1) and count of messages carrying the \Deleted flag
+    SIZE: { key: 'size', parser: value => parseUintValue(value) },
+    DELETED: { key: 'deleted', parser: uint32 }
+};
+
+/**
+ * Walks a STATUS data-item list - alternating item-name and item-value tokens - and reports
+ * every recognized field that parsed successfully. Unknown item names and unusable values are
+ * skipped, so one bad field never costs the rest of the response.
+ *
+ * @param {Array} list - Parsed attribute list from the untagged STATUS response.
+ * @param {Function} onField - Called as (key, value) for each usable field.
+ */
+const parseStatusList = (list, onField) => {
+    let name;
+    list.forEach((entry, i) => {
+        if (i % 2 === 0) {
+            name = entry && typeof entry.value === 'string' ? entry.value : false;
+            return;
+        }
+
+        if (!name || !entry) {
+            return;
+        }
+
+        // The item name is server-controlled, but uppercasing it before the lookup means no
+        // Object.prototype member can be reached: every builtin name has a lowercase letter.
+        const field = STATUS_FIELDS[name.toUpperCase()];
+        if (!field) {
+            return;
+        }
+
+        const value = field.parser(entry.value);
+        if (value === false) {
+            return;
+        }
+
+        onField(field.key, value);
+    });
+};
+
+module.exports = { parseStatusList };

package/lib/commands/status.js

@@ -1,6 +1,25 @@
 'use strict';
 
 const { encodePath, normalizePath, buildStatusQueryAttributes, isRev2Active } = require('../tools.js');
+const { parseStatusList } = require('./status-fields.js');
+
+// STATUS fields that also refresh the live mailbox state when the queried mailbox is the
+// currently selected one. Keyed by the output property name parseStatusList() reports.
+const MAILBOX_UPDATERS = {
+    messages: (value, connection, path) => {
+        let prevCount = connection.mailbox.exists;
+        if (prevCount !== value) {
+            connection.mailbox.exists = value;
+            connection.emit('exists', { path, count: value, prevCount });
+        }
+    },
+    uidNext: (value, connection) => {
+        connection.mailbox.uidNext = value;
+    },
+    highestModseq: (value, connection) => {
+        connection.mailbox.highestModseq = value;
+    }
+};
 
 /**
  * Requests status information about a mailbox.
@@ -56,68 +75,11 @@ module.exports = async (connection, path, query) => {
                     if (!list) {
                         return;
                     }
-                    // Maps IMAP STATUS field names to their output key names, type parsers,
-                    // and optional callbacks to update the live mailbox state.
-                    const STATUS_FIELD_MAP = {
-                        MESSAGES: {
-                            key: 'messages',
-                            parser: Number,
-                            updateMailbox: (val, conn) => {
-                                let prevCount = conn.mailbox.exists;
-                                if (prevCount !== val) {
-                                    conn.mailbox.exists = val;
-                                    conn.emit('exists', { path, count: val, prevCount });
-                                }
-                            }
-                        },
-                        RECENT: { key: 'recent', parser: Number },
-                        UIDNEXT: {
-                            key: 'uidNext',
-                            parser: Number,
-                            updateMailbox: (val, conn) => {
-                                conn.mailbox.uidNext = val;
-                            }
-                        },
-                        UIDVALIDITY: { key: 'uidValidity', parser: BigInt },
-                        UNSEEN: { key: 'unseen', parser: Number },
-                        HIGHESTMODSEQ: {
-                            key: 'highestModseq',
-                            parser: BigInt,
-                            updateMailbox: (val, conn) => {
-                                conn.mailbox.highestModseq = val;
-                            }
-                        },
-                        // IMAP4rev2 additions (RFC 9051): total mailbox size in octets
-                        // (number64, exact as a JS number up to 2^53-1) and count of
-                        // messages with the \Deleted flag
-                        SIZE: { key: 'size', parser: Number },
-                        DELETED: { key: 'deleted', parser: Number }
-                    };
-
-                    let key;
-                    list.forEach((entry, i) => {
-                        if (i % 2 === 0) {
-                            key = entry && typeof entry.value === 'string' ? entry.value : false;
-                            return;
-                        }
-                        if (!key || !entry || typeof entry.value !== 'string') {
-                            return;
-                        }
-
-                        const fieldConfig = STATUS_FIELD_MAP[key.toUpperCase()];
-                        if (!fieldConfig) {
-                            return;
-                        }
-
-                        const value = !isNaN(entry.value) ? fieldConfig.parser(entry.value) : false;
-                        if (value === false) {
-                            return;
-                        }
-
-                        map[fieldConfig.key] = value;
+                    parseStatusList(list, (key, value) => {
+                        map[key] = value;
 
-                        if (updateCurrent && fieldConfig.updateMailbox) {
-                            fieldConfig.updateMailbox(value, connection);
+                        if (updateCurrent && MAILBOX_UPDATERS[key]) {
+                            MAILBOX_UPDATERS[key](value, connection, path);
                         }
                     });
                 }

package/lib/handler/imap-compiler.js

@@ -4,11 +4,27 @@
 
 const imapFormalSyntax = require('./imap-formal-syntax');
 
-// A sequence-set as defined by the RFC 9051 grammar: comma-separated numbers and
-// ranges, where "*" stands for the largest number in use. Digit strings are not
+// A single element of a sequence-set as defined by the RFC 9051 grammar: a number
+// or a range, where "*" stands for the largest number in use. Digit strings are not
 // range-checked here (a server rejects "0" or an overlong number on its own); the
 // point of the check is that nothing outside this alphabet can reach the wire.
-const SEQUENCE_SET = /^(\d+|\*)(:(\d+|\*))?(,(\d+|\*)(:(\d+|\*))?)*$/;
+const SEQ_RANGE = /^(\d+|\*)(:(\d+|\*))?$/;
+
+// Validates a full sequence-set: comma-separated SEQ_RANGE elements, or "$"
+// (RFC 5182 SEARCHRES), which references the previous SEARCH result and is only
+// valid as the entire set. Split into per-element tests on purpose - a whole-set
+// regex with an unbounded repeat group overflows the regex engine's backtrack
+// stack with an uncoded RangeError on valid sets in the million-element range,
+// while the per-element regex is bounded.
+const isValidSequenceSet = value => value === '$' || value.split(',').every(part => SEQ_RANGE.test(part));
+
+// Numeric tokens may only put the digit alphabet on the wire. Anything that does
+// not round to a bounded non-negative integer (NaN, Infinity, negatives, unsafe
+// magnitudes) degrades to 0 - the fallback the NaN coercion has always used.
+const safeNumber = value => {
+    let num = Math.round(Number(value));
+    return Number.isSafeInteger(num) && num >= 0 ? num : 0;
+};
 
 // Characters that cannot appear in an IMAP quoted string: CR and LF terminate a
 // command line, and NUL is outside the CHAR production entirely. A value carrying
@@ -37,33 +53,6 @@ const quoteString = value => {
     return '"' + value.replace(/["\\]/g, char => '\\' + char) + '"';
 };
 
-/**
- * Formats a response entry into a Buffer.
- *
- * @param {string|number|Buffer} entry - The value to convert to a Buffer.
- * @param {boolean} [returnEmpty] - If true, returns null instead of an empty Buffer when the entry is not a recognized type.
- * @returns {Buffer|null} The entry as a Buffer, or null if returnEmpty is true and the entry is not a recognized type.
- */
-const formatRespEntry = (entry, returnEmpty) => {
-    if (typeof entry === 'string') {
-        return Buffer.from(entry);
-    }
-
-    if (typeof entry === 'number') {
-        return Buffer.from(entry.toString());
-    }
-
-    if (Buffer.isBuffer(entry)) {
-        return entry;
-    }
-
-    if (returnEmpty) {
-        return null;
-    }
-
-    return Buffer.alloc(0);
-};
-
 /**
  * Compiles an input object into a sequence of Buffers representing an IMAP protocol response string.
  * Handles various node types including literals, strings, atoms, sections, sequences, and nested lists.
@@ -83,7 +72,43 @@ module.exports = async (response, options) => {
     let { asArray, isLogging, literalPlus, literalMinus } = options || {};
     const respParts = [];
 
-    let resp = [].concat(formatRespEntry(response.tag, true) || []).concat(response.command ? formatRespEntry(' ' + response.command) : []);
+    // Formats an entry (string, number or Buffer) into the Buffer that is written to
+    // the wire, and is the choke point every emission passes through: a line
+    // terminator ends an IMAP command, so no token - the tag and command name
+    // included - may put one on the wire. The literal size marker and literal data
+    // are the only emissions where CRLF is legitimate; those call sites opt out with
+    // `raw`. Never enforced when logging: re-encoding an incoming server response for
+    // the log or for error text must not throw, whatever the server sent. With
+    // `returnEmpty`, an unrecognized entry type yields null instead of an empty
+    // Buffer.
+    const emitEntry = (entry, opts) => {
+        let { returnEmpty, raw } = opts || {};
+        if (!raw && !isLogging && (typeof entry === 'string' || Buffer.isBuffer(entry)) && CRLF.test(entry.toString('latin1'))) {
+            let error = new Error('Line terminator in IMAP token');
+            error.code = 'InvalidTokenValue';
+            throw error;
+        }
+
+        if (typeof entry === 'string') {
+            return Buffer.from(entry);
+        }
+
+        if (typeof entry === 'number') {
+            return Buffer.from(entry.toString());
+        }
+
+        if (Buffer.isBuffer(entry)) {
+            return entry;
+        }
+
+        if (returnEmpty) {
+            return null;
+        }
+
+        return Buffer.alloc(0);
+    };
+
+    let resp = [].concat(emitEntry(response.tag, { returnEmpty: true }) || []).concat(response.command ? emitEntry(' ' + response.command) : []);
     let val;
     let lastType;
 
@@ -108,7 +133,7 @@ module.exports = async (response, options) => {
         // adjacent lists).
         if (lastType === 'LITERAL' || (!['(', '<', '['].includes(lastRespByte) && resp.length)) {
             if (!options.subArray) {
-                resp.push(formatRespEntry(' '));
+                resp.push(emitEntry(' '));
             }
         }
 
@@ -119,7 +144,7 @@ module.exports = async (response, options) => {
 
         if (Array.isArray(node)) {
             lastType = 'LIST';
-            resp.push(formatRespEntry('('));
+            resp.push(emitEntry('('));
 
             // check if we need to skip separator WS between two arrays
             let subArray = node.length > 1 && Array.isArray(node[0]);
@@ -131,40 +156,40 @@ module.exports = async (response, options) => {
                 await walk(child, { subArray });
             }
 
-            resp.push(formatRespEntry(')'));
+            resp.push(emitEntry(')'));
             return;
         }
 
         if (!node && typeof node !== 'string' && typeof node !== 'number' && !Buffer.isBuffer(node)) {
-            resp.push(formatRespEntry('NIL'));
+            resp.push(emitEntry('NIL'));
             return;
         }
 
         if (typeof node === 'string' || Buffer.isBuffer(node)) {
             if (isLogging && node.length > 100) {
-                resp.push(formatRespEntry('"(* ' + node.length + 'B string *)"'));
+                resp.push(emitEntry('"(* ' + node.length + 'B string *)"'));
             } else {
-                resp.push(formatRespEntry(isLogging ? JSON.stringify(node.toString()) : quoteString(node.toString())));
+                resp.push(emitEntry(isLogging ? JSON.stringify(node.toString()) : quoteString(node.toString())));
             }
             return;
         }
 
         if (typeof node === 'number') {
-            resp.push(formatRespEntry(Math.round(node) || 0)); // Only integers allowed
+            resp.push(emitEntry(safeNumber(node))); // Only bounded non-negative integers allowed
             return;
         }
 
         lastType = node.type;
 
         if (isLogging && node.sensitive) {
-            resp.push(formatRespEntry('"(* value hidden *)"'));
+            resp.push(emitEntry('"(* value hidden *)"'));
             return;
         }
 
         switch (node.type.toUpperCase()) {
             case 'LITERAL':
                 if (isLogging) {
-                    resp.push(formatRespEntry('"(* ' + node.value.length + 'B literal *)"'));
+                    resp.push(emitEntry('"(* ' + node.value.length + 'B literal *)"'));
                 } else {
                     // The literal size marker counts octets - string values are written as
                     // UTF-8, so their UTF-16 .length would undercount multi-byte characters
@@ -180,29 +205,29 @@ module.exports = async (response, options) => {
                     let canAppend = !asArray || usePlus;
 
                     // Emit the literal header: optional '~' prefix for literal8, then {size[+]}\r\n
-                    resp.push(formatRespEntry(`${node.isLiteral8 ? '~' : ''}{${literalLength}${usePlus ? '+' : ''}}\r\n`));
+                    resp.push(emitEntry(`${node.isLiteral8 ? '~' : ''}{${literalLength}${usePlus ? '+' : ''}}\r\n`, { raw: true }));
 
                     if (canAppend) {
                         // Literal data follows immediately in the same buffer segment
                         if (node.value && node.value.length) {
-                            resp.push(formatRespEntry(node.value));
+                            resp.push(emitEntry(node.value, { raw: true }));
                         }
                     } else {
                         // For synchronizing literals in asArray mode, split output into separate
                         // parts. The caller must send each part and wait for a continuation
                         // response from the server before sending the next.
                         respParts.push(resp);
-                        resp = [].concat(formatRespEntry(node.value, true) || []);
+                        resp = [].concat(emitEntry(node.value, { returnEmpty: true, raw: true }) || []);
                     }
                 }
                 break;
 
             case 'STRING':
                 if (isLogging && node.value.length > 100) {
-                    resp.push(formatRespEntry('"(* ' + node.value.length + 'B string *)"'));
+                    resp.push(emitEntry('"(* ' + node.value.length + 'B string *)"'));
                 } else {
                     val = (node.value || '').toString();
-                    resp.push(formatRespEntry(isLogging ? JSON.stringify(val) : quoteString(val)));
+                    resp.push(emitEntry(isLogging ? JSON.stringify(val) : quoteString(val)));
                 }
                 break;
 
@@ -210,34 +235,39 @@ module.exports = async (response, options) => {
                 // Sequence sets are written verbatim - they are the one token type with
                 // no quoting to fall back on. Callers build them from user-supplied
                 // ranges, so validate here, at the single point every outgoing sequence
-                // set passes through, rather than trusting each command module. Values
-                // the parser produced for a server response are already within this
-                // alphabet, so re-compiling a response (logging, error text) is unaffected.
-                if (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value)) {
+                // set passes through, rather than trusting each command module. Skipped
+                // when logging: the incoming token parser accepts sequence-shaped tokens
+                // this strict grammar rejects (an ESEARCH set like "1:2:3", a folder
+                // name like "12:30:00"), and re-compiling a server response for the log
+                // or for error text must never throw.
+                if (!isLogging && (typeof node.value === 'string' || typeof node.value === 'number' || Buffer.isBuffer(node.value))) {
                     val = node.value.toString();
-                    if (val && !SEQUENCE_SET.test(val)) {
+                    if (val && !isValidSequenceSet(val)) {
                         let error = new Error('Invalid sequence set value');
                         error.code = 'InvalidSequenceSet';
                         throw error;
                     }
                 }
                 if (node.value) {
-                    resp.push(formatRespEntry(node.value));
+                    // raw: the validated alphabet cannot contain a line terminator, and
+                    // re-scanning a potentially multi-megabyte set in the choke point
+                    // would double the cost of exactly the sets this branch exists for
+                    resp.push(emitEntry(node.value, { raw: true }));
                 }
                 break;
 
             case 'TEXT':
                 // Response text is written verbatim. Only the parser produces it today, for
                 // incoming lines, so this is a re-encoding path rather than a command-building
-                // one - but the choke point is only worth anything if it holds for every token
-                // type, so a line terminator is refused here too.
+                // one. The emitEntry choke point would refuse a line terminator here too;
+                // this check runs first only to raise the more specific InvalidTextValue code.
                 if (node.value) {
                     if (!isLogging && CRLF.test(node.value.toString())) {
                         let error = new Error('Line terminator in IMAP text value');
                         error.code = 'InvalidTextValue';
                         throw error;
                     }
-                    resp.push(formatRespEntry(node.value));
+                    resp.push(emitEntry(node.value));
                 }
                 break;
 
@@ -245,7 +275,7 @@ module.exports = async (response, options) => {
                 // Coerced rather than written through: formatRespEntry passes a string or
                 // Buffer straight to the wire, so a numeric token carrying a string value
                 // would be another verbatim channel
-                resp.push(formatRespEntry(Math.round(Number(node.value)) || 0));
+                resp.push(emitEntry(safeNumber(node.value)));
                 break;
 
             case 'ATOM':
@@ -255,24 +285,25 @@ module.exports = async (response, options) => {
                 if (!node.section || val) {
                     // Verify the value contains only valid ATOM-CHAR characters.
                     // Strip a leading backslash before checking (system flags like \Seen start with '\').
-                    // If any character fails verification, quote-escape the entire value with JSON.stringify.
+                    // If any character fails verification, fall back to an IMAP quoted string
+                    // (JSON.stringify is used only for log output, where values are display-escaped).
                     if (node.value === '' || imapFormalSyntax.verify(val.charAt(0) === '\\' ? val.substr(1) : val, imapFormalSyntax['ATOM-CHAR']()) >= 0) {
                         val = isLogging ? JSON.stringify(val) : quoteString(val);
                     }
 
-                    resp.push(formatRespEntry(val));
+                    resp.push(emitEntry(val));
                 }
 
                 // Section bracket handling: emit [section-contents] after the ATOM value
                 // e.g., BODY[HEADER.FIELDS (Subject)] or BODY[1.MIME]
                 if (node.section) {
-                    resp.push(formatRespEntry('['));
+                    resp.push(emitEntry('['));
 
                     for (let child of node.section) {
                         await walk(child);
                     }
 
-                    resp.push(formatRespEntry(']'));
+                    resp.push(emitEntry(']'));
                 }
                 // Partial range: emit <origin.length> after the section brackets. Coerced
                 // rather than joined as-is: this is the last token component written
@@ -280,7 +311,7 @@ module.exports = async (response, options) => {
                 // all of them. Every producer already passes numbers, so nothing changes
                 // for them.
                 if (node.partial) {
-                    resp.push(formatRespEntry(`<${node.partial.map(entry => Number(entry) || 0).join('.')}>`));
+                    resp.push(emitEntry(`<${node.partial.map(safeNumber).join('.')}>`));
                 }
                 break;
         }

package/lib/handler/imap-parser.js

@@ -81,6 +81,13 @@ module.exports = async (command, options) => {
         if (err.code === 'ParserErrorExchange' && err.parserContext && err.parserContext.value) {
             return err.parserContext.value;
         }
+        if (response.tag) {
+            // The tag had already been parsed when the rest of the line failed. Expose it
+            // so the connection can settle the command this line was addressed to - unlike
+            // re-deriving the tag from the raw bytes, this inherits the leading-NUL
+            // workaround above.
+            err.parsedTag = response.tag;
+        }
         throw err;
     }
 

package/lib/handler/imap-stream.js

@@ -2,7 +2,7 @@
 
 const Transform = require('stream').Transform;
 const logger = require('../logger');
-const { MAX_LITERAL_SIZE, MAX_LINE_SIZE, normalizeLimit, createLiteralTooLargeError } = require('./limits');
+const { MAX_LITERAL_SIZE, MAX_LINE_SIZE, MAX_RESPONSE_SIZE, normalizeLimit, createLiteralTooLargeError } = require('./limits');
 
 const LINE = 0x01;
 const LITERAL = 0x02;
@@ -44,6 +44,16 @@ class ImapStream extends Transform {
      *   exactly at the limit is accepted. Exceeding it is terminal: the stream is destroyed with a
      *   `LiteralTooLarge` error, the marker line is not emitted, and no byte of the rejected
      *   literal body is parsed as protocol.
+     * @param {number} [options.maxResponseSize] - Maximum allowed total size (in bytes) of a
+     *   single assembled response: every line segment and literal of one response combined.
+     *   Defaults to MAX_RESPONSE_SIZE (2GB), which leaves room above the literal cap for a
+     *   maximum-size literal plus its marker line. The per-line and per-literal caps alone
+     *   cannot stop a server that spreads attacker-controlled bytes across an unbounded
+     *   number of tokens of a single response. Declared literal sizes count when their
+     *   marker is parsed, so an oversized total is rejected before the literal bytes arrive,
+     *   and a line still being assembled counts against whatever budget is left.
+     *   Exceeding the limit is terminal: the stream is destroyed with a `ResponseTooLarge`
+     *   error and no further input is parsed.
      */
     constructor(options) {
         super({
@@ -73,6 +83,8 @@ class ImapStream extends Transform {
         // announcing an oversized literal cannot exhaust memory.
         this.maxLiteralSize = normalizeLimit(this.options.maxLiteralSize, MAX_LITERAL_SIZE);
 
+        this.maxResponseSize = normalizeLimit(this.options.maxResponseSize, MAX_RESPONSE_SIZE);
+
         this.state = LINE;
         this.literalWaiting = 0;
         this.inputBuffer = []; // lines
@@ -80,6 +92,7 @@ class ImapStream extends Transform {
         this.lineBytes = 0; // bytes currently buffered for the in-progress line
         this.literalBuffer = [];
         this.literals = [];
+        this.responseBytes = 0; // bytes accumulated for the in-progress response (lines + declared literals)
 
         this.compress = false;
         this.secureConnection = this.options.secureConnection;
@@ -166,23 +179,35 @@ class ImapStream extends Transform {
 
         // Scan backwards through the line to find an IMAP literal marker: {size}\r\n
         // The format is: '{' followed by one or more ASCII digits followed by '}'.
-        // Only the digit run's bounds are tracked, and the run is capped: the size is
-        // a number64 at most, so anything longer cannot be a valid marker. Collecting
-        // the digits into a growing array instead would make a line of n digits cost
-        // O(n^2), letting a few hundred KB of digits block the event loop for seconds
-        // before the size is even known - well inside the default line-length cap.
-        const MAX_SIZE_DIGITS = 19;
+        // Only the digit run's bounds are tracked - a single linear pass, unlike
+        // collecting digits into a growing array, which would make a line of n digits
+        // cost O(n^2). The run length is deliberately not capped: the RFC "number"
+        // production permits leading zeros, so a long digit run can still denote a
+        // small, valid size, and treating the marker as an ordinary line instead
+        // would feed the announced literal body to the line parser and desynchronize
+        // the session.
         let digitsEnd = pos;
         for (; pos >= 0; pos--) {
             let c = line[pos];
             if (c >= NUM_0 && c <= NUM_9) {
-                if (digitsEnd - pos >= MAX_SIZE_DIGITS) {
-                    return false;
-                }
                 continue;
             }
             if (c === CURLY_OPEN && pos < digitsEnd) {
-                const literalSize = Number(line.toString('latin1', pos + 1, digitsEnd + 1));
+                // Skip leading zeros so only the significant digits are converted: a
+                // marker padded with megabytes of zeros must not cost a string
+                // allocation and Number() parse of the whole run.
+                let digitsStart = pos + 1;
+                while (digitsStart < digitsEnd && line[digitsStart] === NUM_0) {
+                    digitsStart++;
+                }
+
+                // More significant digits than any number64 has cannot fit any
+                // permissible maxLiteralSize; fail closed without materializing them
+                if (digitsEnd + 1 - digitsStart > 19) {
+                    return this.failStream(createLiteralTooLargeError(Infinity, this.maxLiteralSize, 'the widest permissible literal size (19 digits)'));
+                }
+
+                const literalSize = Number(line.toString('latin1', digitsStart, digitsEnd + 1));
 
                 if (literalSize > this.maxLiteralSize) {
                     return this.failStream(createLiteralTooLargeError(literalSize, this.maxLiteralSize));
@@ -216,6 +241,33 @@ class ImapStream extends Transform {
         return this.failStream(err);
     }
 
+    /**
+     * Enforces the configured per-response size cap: the cumulative bytes of every line
+     * segment and declared literal of the response currently being assembled. Counting
+     * declared literal sizes at marker time means an oversized total is rejected before
+     * the literal bytes even arrive. The counter is reset when a response is emitted.
+     *
+     * @param {number} additionalBytes - Bytes the next token would add to the response.
+     * @param {boolean} [peek] - Measure only, without committing the bytes to the counter.
+     *   Used for a line that is still being assembled: its bytes are committed once, when the
+     *   line completes.
+     * @returns {boolean} True if within the limit, false if the stream was failed.
+     */
+    checkResponseSize(additionalBytes, peek) {
+        let total = this.responseBytes + additionalBytes;
+        if (total <= this.maxResponseSize) {
+            if (!peek) {
+                this.responseBytes = total;
+            }
+            return true;
+        }
+        const err = new Error(`Response size ${total} exceeds maximum allowed size of ${this.maxResponseSize} bytes`);
+        err.code = 'ResponseTooLarge';
+        err.responseSize = total;
+        err.maxSize = this.maxResponseSize;
+        return this.failStream(err);
+    }
+
     /**
      * Processes a single input chunk of raw data. In LINE state, scans for LF-terminated
      * lines and checks for literal markers. In LITERAL state, collects the expected number
@@ -261,6 +313,13 @@ class ImapStream extends Transform {
                             return;
                         }
 
+                        // Count the line itself and, for a literal marker, the declared
+                        // literal bytes against the cumulative per-response budget, so a
+                        // response assembled from many tokens stays bounded as a whole
+                        if (!this.checkResponseSize(line.length + (isLiteralMarker ? this.literalWaiting : 0))) {
+                            return;
+                        }
+
                         this.inputBuffer.push(line);
 
                         if (isLiteralMarker) {
@@ -273,6 +332,7 @@ class ImapStream extends Transform {
                         let literals = this.literals;
                         this.inputBuffer = [];
                         this.literals = [];
+                        this.responseBytes = 0;
 
                         if (payload.length) {
                             // remove final line terminator (\n or \r\n)
@@ -311,7 +371,12 @@ class ImapStream extends Transform {
                     // No line terminator was found in the remaining bytes; carry the tail over to
                     // the next chunk after measuring the line it belongs to.
                     let tail = chunk.slice(lineStart);
-                    if (!this.checkLineLength(this.lineBytes + tail.length)) {
+                    // The response counter is only committed when a line completes, so an
+                    // in-progress line is measured against the remaining budget separately.
+                    // Without this a response cap lowered to bound parser memory buys nothing
+                    // while a server streams a line that never terminates - only the much
+                    // larger line cap would hold it back.
+                    if (!this.checkLineLength(this.lineBytes + tail.length) || !this.checkResponseSize(this.lineBytes + tail.length, true)) {
                         return;
                     }
                     this.lineBytes += tail.length;
@@ -441,6 +506,7 @@ class ImapStream extends Transform {
         this.lineBytes = 0;
         this.literalBuffer = [];
         this.literals = [];
+        this.responseBytes = 0;
 
         // Settle an in-flight push() wait so processInput() can unwind
         if (typeof this.pendingPush === 'function') {