imapflow 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [2.4.3](https://github.com/postalsys/imapflow/compare/v2.4.2...v2.4.3) (2026-10-15)
+
+
+### Bug Fixes
+
+* fail the command on a NO or BAD status line without a tag ([5a38e17](https://github.com/postalsys/imapflow/commit/5a38e171ad8405583b090872076f464c4dc6f0e2))
+* send ID after STARTTLS instead of before it ([7d6f37a](https://github.com/postalsys/imapflow/commit/7d6f37a4e8eb2f9b0f921f6b004a1ba5e45b1867))
+* send ID after STARTTLS instead of before it ([197ecdc](https://github.com/postalsys/imapflow/commit/197ecdc49f2f64c45ee98c4e4284534662e26942))
+
+## [2.4.2](https://github.com/postalsys/imapflow/compare/v2.4.1...v2.4.2) (2026-10-14)
+
+
+### Bug Fixes
+
+* **deps:** update libmime to 5.4.8 and mailsplit to 5.4.21 ([8eafb46](https://github.com/postalsys/imapflow/commit/8eafb46f858893670dda1be115899b8b761391ab))
+
 ## [2.4.1](https://github.com/postalsys/imapflow/compare/v2.4.0...v2.4.1) (2026-10-14)
 
 

package/dist/cjs/errors.d.ts

@@ -20,6 +20,7 @@ export declare const ImapFlowErrorCode: {
     readonly LockTimeout: "LockTimeout";
     readonly ETHROTTLE: "ETHROTTLE";
     readonly UnexpectedTag: "UnexpectedTag";
+    readonly MissingTag: "MissingTag";
     readonly InvalidResponse: "InvalidResponse";
     readonly ResponseProcessingFailed: "ResponseProcessingFailed";
     readonly STARTTLS_INJECTION: "STARTTLS_INJECTION";

package/dist/cjs/errors.js

@@ -26,6 +26,7 @@ exports.ImapFlowErrorCode = {
     // the server
     ETHROTTLE: 'ETHROTTLE',
     UnexpectedTag: 'UnexpectedTag',
+    MissingTag: 'MissingTag',
     InvalidResponse: 'InvalidResponse',
     ResponseProcessingFailed: 'ResponseProcessingFailed',
     STARTTLS_INJECTION: 'STARTTLS_INJECTION',

package/dist/cjs/imap-flow.js

@@ -781,7 +781,7 @@ class ImapFlow extends node_events_1.EventEmitter {
      */
     rejectUnparsedCompletion(payload, parserError) {
         if (!this.currentRequest || !this.currentRequest.sent) {
-            return;
+            return false;
         }
         // Prefer the tag the parser had already extracted before it failed - it went
         // through the same leading-NUL workaround as every parsed response. Fall back
@@ -793,11 +793,45 @@ class ImapFlow extends node_events_1.EventEmitter {
             tag = match && match[1];
         }
         if (!tag || tag !== this.currentRequest.tag) {
-            return;
+            return false;
         }
         let err = new Error('Failed to parse the server response for this command');
         err.code = parserError.code || 'ParserError';
         err.parserError = parserError;
+        this.failInFlight(err);
+        return true;
+    }
+    /**
+     * Fails the in-flight command when the server answered it with a NO or BAD status line that
+     * has no tag at all (Namecheap Private Email: `BAD "Must issue a STARTTLS command first"`).
+     * Only one command is ever on the wire, and leaving it pending would stall the connection
+     * until the socket timeout. Tags are uppercase hex, so a command can carry the tag BAD:
+     * callers check for the command's own tag first.
+     *
+     * @param payload - Raw bytes of the line.
+     * @returns `true` when the line failed the in-flight command
+     * @internal
+     */
+    rejectTaglessCompletion(payload) {
+        if (!this.currentRequest || !this.currentRequest.sent) {
+            return false;
+        }
+        let match = payload.toString('latin1', 0, 1024).match(/^\0*(BAD|NO)(?:\s+([^]*))?$/i);
+        if (!match) {
+            return false;
+        }
+        let err = (0, errors_js_1.createImapError)('Command failed', 'MissingTag', {
+            command: this.currentRequest.command,
+            responseStatus: match[1].toUpperCase(),
+            responseText: (match[2] || '').trim().replace(/^"(.*)"$/, '$1')
+        });
+        this.log.warn({ msg: 'Server sent a status response without a tag', err, cid: this.id });
+        this.failInFlight(err);
+        return true;
+    }
+    // Rejects the in-flight command and moves on to the next queued one
+    /** @internal */
+    failInFlight(err) {
         this.rejectCurrentRequest(err);
         this.trySend().catch(sendErr => (0, tools_js_1.logConnectionError)(this, 'Failed to dispatch command', sendErr));
     }
@@ -847,7 +881,9 @@ class ImapFlow extends node_events_1.EventEmitter {
             // timeout fires. The tag is recovered from the raw bytes (a tag is
             // ASTRING-CHAR only, so it survives whatever made the rest unparseable) and
             // the command is failed with the parser error instead of hanging.
-            this.rejectUnparsedCompletion(data.payload, err);
+            if (!this.rejectUnparsedCompletion(data.payload, err)) {
+                this.rejectTaglessCompletion(data.payload);
+            }
             return true;
         }
         if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
@@ -952,7 +988,8 @@ class ImapFlow extends node_events_1.EventEmitter {
         // actually written to the socket (invariant 2), so the three cases below are kept apart:
         // the active command completes, a command that has not been written yet is proof of
         // desynchronization (queued behind another command, or current but not yet on the wire),
-        // and an entirely unknown tag is recorded but tolerated.
+        // and an entirely unknown tag is recorded but tolerated, unless the line is a NO or BAD
+        // that came without a tag (see rejectTaglessCompletion()).
         if (parsed.tag && !['*', '+'].includes(parsed.tag)) {
             if (this.currentRequest && this.currentRequest.tag === parsed.tag && this.currentRequest.sent) {
                 let request = this.takeCurrentRequest();
@@ -990,7 +1027,7 @@ class ImapFlow extends node_events_1.EventEmitter {
                 this.failProtocol(err);
                 return false;
             }
-            else {
+            else if (!this.rejectTaglessCompletion(data.payload)) {
                 this.countUnknownTag(parsed.tag);
             }
         }
@@ -1266,10 +1303,14 @@ class ImapFlow extends node_events_1.EventEmitter {
     /** @internal */
     async startSession() {
         await this.run('CAPABILITY');
+        await this.upgradeToSTARTTLS();
+        // ID goes after STARTTLS: the client info should not travel in cleartext, and some
+        // servers refuse every command but STARTTLS before the upgrade with an untagged BAD
+        // the client can not tie to ID, which then waits for the socket timeout (Namecheap
+        // Private Email). The capability list was refreshed by the upgrade.
         if (this.capabilities.has('ID')) {
             this.idRequested = await this.run('ID', this.clientInfo);
         }
-        await this.upgradeToSTARTTLS();
         await this.authenticate();
         if ((!this.idRequested || Object.keys(this.idRequested).length < 2) && this.capabilities.has('ID')) {
             // re-request ID after LOGIN

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.4.1";
+export declare const version = "2.4.3";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.4.1";
+exports.version = "2.4.3";
 exports.homepage = "https://imapflow.com/";

package/dist/esm/errors.d.ts

@@ -20,6 +20,7 @@ export declare const ImapFlowErrorCode: {
     readonly LockTimeout: "LockTimeout";
     readonly ETHROTTLE: "ETHROTTLE";
     readonly UnexpectedTag: "UnexpectedTag";
+    readonly MissingTag: "MissingTag";
     readonly InvalidResponse: "InvalidResponse";
     readonly ResponseProcessingFailed: "ResponseProcessingFailed";
     readonly STARTTLS_INJECTION: "STARTTLS_INJECTION";

package/dist/esm/errors.js

@@ -22,6 +22,7 @@ export const ImapFlowErrorCode = {
     // the server
     ETHROTTLE: 'ETHROTTLE',
     UnexpectedTag: 'UnexpectedTag',
+    MissingTag: 'MissingTag',
     InvalidResponse: 'InvalidResponse',
     ResponseProcessingFailed: 'ResponseProcessingFailed',
     STARTTLS_INJECTION: 'STARTTLS_INJECTION',

package/dist/esm/imap-flow.js

@@ -740,7 +740,7 @@ export class ImapFlow extends EventEmitter {
      */
     rejectUnparsedCompletion(payload, parserError) {
         if (!this.currentRequest || !this.currentRequest.sent) {
-            return;
+            return false;
         }
         // Prefer the tag the parser had already extracted before it failed - it went
         // through the same leading-NUL workaround as every parsed response. Fall back
@@ -752,11 +752,45 @@ export class ImapFlow extends EventEmitter {
             tag = match && match[1];
         }
         if (!tag || tag !== this.currentRequest.tag) {
-            return;
+            return false;
         }
         let err = new Error('Failed to parse the server response for this command');
         err.code = parserError.code || 'ParserError';
         err.parserError = parserError;
+        this.failInFlight(err);
+        return true;
+    }
+    /**
+     * Fails the in-flight command when the server answered it with a NO or BAD status line that
+     * has no tag at all (Namecheap Private Email: `BAD "Must issue a STARTTLS command first"`).
+     * Only one command is ever on the wire, and leaving it pending would stall the connection
+     * until the socket timeout. Tags are uppercase hex, so a command can carry the tag BAD:
+     * callers check for the command's own tag first.
+     *
+     * @param payload - Raw bytes of the line.
+     * @returns `true` when the line failed the in-flight command
+     * @internal
+     */
+    rejectTaglessCompletion(payload) {
+        if (!this.currentRequest || !this.currentRequest.sent) {
+            return false;
+        }
+        let match = payload.toString('latin1', 0, 1024).match(/^\0*(BAD|NO)(?:\s+([^]*))?$/i);
+        if (!match) {
+            return false;
+        }
+        let err = createImapError('Command failed', 'MissingTag', {
+            command: this.currentRequest.command,
+            responseStatus: match[1].toUpperCase(),
+            responseText: (match[2] || '').trim().replace(/^"(.*)"$/, '$1')
+        });
+        this.log.warn({ msg: 'Server sent a status response without a tag', err, cid: this.id });
+        this.failInFlight(err);
+        return true;
+    }
+    // Rejects the in-flight command and moves on to the next queued one
+    /** @internal */
+    failInFlight(err) {
         this.rejectCurrentRequest(err);
         this.trySend().catch(sendErr => logConnectionError(this, 'Failed to dispatch command', sendErr));
     }
@@ -806,7 +840,9 @@ export class ImapFlow extends EventEmitter {
             // timeout fires. The tag is recovered from the raw bytes (a tag is
             // ASTRING-CHAR only, so it survives whatever made the rest unparseable) and
             // the command is failed with the parser error instead of hanging.
-            this.rejectUnparsedCompletion(data.payload, err);
+            if (!this.rejectUnparsedCompletion(data.payload, err)) {
+                this.rejectTaglessCompletion(data.payload);
+            }
             return true;
         }
         if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
@@ -911,7 +947,8 @@ export class ImapFlow extends EventEmitter {
         // actually written to the socket (invariant 2), so the three cases below are kept apart:
         // the active command completes, a command that has not been written yet is proof of
         // desynchronization (queued behind another command, or current but not yet on the wire),
-        // and an entirely unknown tag is recorded but tolerated.
+        // and an entirely unknown tag is recorded but tolerated, unless the line is a NO or BAD
+        // that came without a tag (see rejectTaglessCompletion()).
         if (parsed.tag && !['*', '+'].includes(parsed.tag)) {
             if (this.currentRequest && this.currentRequest.tag === parsed.tag && this.currentRequest.sent) {
                 let request = this.takeCurrentRequest();
@@ -949,7 +986,7 @@ export class ImapFlow extends EventEmitter {
                 this.failProtocol(err);
                 return false;
             }
-            else {
+            else if (!this.rejectTaglessCompletion(data.payload)) {
                 this.countUnknownTag(parsed.tag);
             }
         }
@@ -1225,10 +1262,14 @@ export class ImapFlow extends EventEmitter {
     /** @internal */
     async startSession() {
         await this.run('CAPABILITY');
+        await this.upgradeToSTARTTLS();
+        // ID goes after STARTTLS: the client info should not travel in cleartext, and some
+        // servers refuse every command but STARTTLS before the upgrade with an untagged BAD
+        // the client can not tie to ID, which then waits for the socket timeout (Namecheap
+        // Private Email). The capability list was refreshed by the upgrade.
         if (this.capabilities.has('ID')) {
             this.idRequested = await this.run('ID', this.clientInfo);
         }
-        await this.upgradeToSTARTTLS();
         await this.authenticate();
         if ((!this.idRequested || Object.keys(this.idRequested).length < 2) && this.capabilities.has('ID')) {
             // re-request ID after LOGIN

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.4.1";
+export declare const version = "2.4.3";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.4.1";
+export const version = "2.4.3";
 export const homepage = "https://imapflow.com/";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.4.1",
+    "version": "2.4.3",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -81,14 +81,14 @@
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
         "typescript-eslint": "8.71.2",
-        "wrangler": "4.150.0"
+        "wrangler": "4.151.0"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.20",
+        "@zone-eu/mailsplit": "5.4.21",
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.3.3",
-        "libmime": "5.4.7",
+        "libmime": "5.4.8",
         "libqp": "2.1.2",
         "pino": "10.3.1",
         "socks": "2.8.10"