imapflow 2.5.8 → 2.5.9

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [2.5.9](https://github.com/postalsys/imapflow/compare/v2.5.8...v2.5.9) (2026-10-20)
+
+
+### Bug Fixes
+
+* bound the parse cost of responses with many literals or tokens ([cb2124f](https://github.com/postalsys/imapflow/commit/cb2124f7a4db4a4c3ec0f15bffa6e8d6e81c2426))
+* do not report APPENDUID UIDVALIDITY next to a looked up UID ([#448](https://github.com/postalsys/imapflow/issues/448)) ([b5aadd3](https://github.com/postalsys/imapflow/commit/b5aadd399599f600009bb4db8ce16fdc574d7ce6))
+
 ## [2.5.8](https://github.com/postalsys/imapflow/compare/v2.5.7...v2.5.8) (2026-10-19)
 
 

package/dist/cjs/commands/append.js

@@ -144,11 +144,14 @@ async function append(connection, destination, content, flags, idate) {
                 // message was already stored and a retrying caller would duplicate it.
                 let uidValidity = (0, tools_js_1.parseBigIntValue)(section[1] && section[1].value, tools_js_1.MAX_UINT32_DIGITS);
                 let uid = (0, tools_js_1.parseUintValue)(section[2] && section[2].value, tools_js_1.MAX_UINT32_DIGITS);
-                if (uidValidity !== false) {
-                    map.uidValidity = uidValidity;
-                }
+                // UIDVALIDITY is only reported next to the UID it was sent with: kept without one,
+                // it would end up paired with the UID the SEARCH fallback below guesses from the
+                // sequence number, and the pair would pass for a server-confirmed identity.
                 if (uid) {
                     map.uid = uid;
+                    if (uidValidity) {
+                        map.uidValidity = uidValidity;
+                    }
                 }
             }
         }

package/dist/cjs/errors.d.ts

@@ -35,6 +35,7 @@ export declare const ImapFlowErrorCode: {
     readonly LineTooLarge: "LineTooLarge";
     readonly LiteralTooLarge: "LiteralTooLarge";
     readonly ResponseTooLarge: "ResponseTooLarge";
+    readonly TooManyTokens: "TooManyTokens";
     readonly TooManyResponses: "TooManyResponses";
     readonly InvalidStringValue: "InvalidStringValue";
     readonly InvalidTokenValue: "InvalidTokenValue";
@@ -117,7 +118,7 @@ export interface ImapFlowError extends Error {
     lineLength?: number | undefined;
     /** The size of a rejected response */
     responseSize?: number | undefined;
-    /** The bound that was exceeded */
+    /** The bound that was exceeded (bytes, or tokens for TooManyTokens) */
     maxSize?: number | undefined;
     /** OAuth error details from the server, for XOAUTH2 authentication failures */
     oauthError?: any;

package/dist/cjs/errors.js

@@ -43,6 +43,7 @@ exports.ImapFlowErrorCode = {
     LineTooLarge: 'LineTooLarge',
     LiteralTooLarge: 'LiteralTooLarge',
     ResponseTooLarge: 'ResponseTooLarge',
+    TooManyTokens: 'TooManyTokens',
     // one command received more untagged responses than are kept, see MAX_COLLECTED_RESPONSES
     TooManyResponses: 'TooManyResponses',
     // invalid values in a command

package/dist/cjs/handler/imap-parser.js

@@ -9,8 +9,8 @@ const parser_instance_js_1 = require("./parser-instance.js");
 const errors_js_1 = require("../errors.js");
 const limits_js_1 = require("./limits.js");
 // The codes the parser raises on purpose: the numbered ParserErrorN codes, ParserErrorExchange,
-// the nesting limit and the inline literal size limit
-const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge)$/;
+// the nesting limit, the inline literal size limit and the token limit
+const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge|TooManyTokens)$/;
 /**
  * Anything the parser throws other than one of its own coded errors - a TypeError from a parser
  * bug, a RangeError from runaway recursion or a bad Buffer offset (which carries a Node code), a
@@ -81,6 +81,39 @@ function readSearchNumbers(str) {
     numbers.push(value);
     return numbers;
 }
+// The CONDSTORE list that ends a SEARCH answer to a MODSEQ query (RFC 7162 section 3.1.5)
+const RE_SEARCH_MODSEQ = /^ \(MODSEQ (\d{1,19})\) *$/i;
+/**
+ * Reads an untagged SEARCH response without the tokenizer, see readSearchNumbers(): the numbers,
+ * and the MODSEQ value of a trailing CONDSTORE list. A MODSEQ query on a large mailbox matches as
+ * many messages as any other, so its answer must not fall back to the tokenizer either.
+ *
+ * @param str - The rest of the line after the command
+ * @returns The numbers, with the MODSEQ list as the attributes the tokenizer would have made of
+ *   it, or null when the line is left to the tokenizer
+ */
+function readSearchResponse(str) {
+    // the last character tells whether there is a list to look for, without scanning the line
+    if (!str.trimEnd().endsWith(')')) {
+        const numbers = readSearchNumbers(str);
+        return numbers && { numbers };
+    }
+    const open = str.lastIndexOf(' (');
+    const match = open < 0 ? null : RE_SEARCH_MODSEQ.exec(str.slice(open));
+    if (!match) {
+        return null;
+    }
+    const numbers = readSearchNumbers(str.slice(0, open));
+    return (numbers && {
+        numbers,
+        attributes: [
+            [
+                { type: 'ATOM', value: 'MODSEQ' },
+                { type: 'ATOM', value: match[1] }
+            ]
+        ]
+    });
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -136,10 +169,9 @@ async function parser(command, options) {
             response.command += ' ' + (await parserInstance.getElement(imap_formal_syntax_js_1.default.command()));
         }
         if (response.tag === '*' && (response.command || '').toUpperCase() === 'SEARCH') {
-            const numbers = readSearchNumbers(parserInstance.remainder);
-            if (numbers) {
-                response.numbers = numbers;
-                return response;
+            const search = readSearchResponse(parserInstance.remainder);
+            if (search) {
+                return Object.assign(response, search);
             }
         }
         if (parserInstance.remainder.trim().length) {

package/dist/cjs/handler/limits.d.ts

@@ -2,6 +2,7 @@ import { type ImapFlowError } from '../errors.js';
 export declare const MAX_LITERAL_SIZE: number;
 export declare const MAX_LINE_SIZE: number;
 export declare const MAX_RESPONSE_SIZE: number;
+export declare const MAX_RESPONSE_TOKENS = 1000000;
 export declare const ERROR_CONTEXT_LENGTH = 1024;
 /**
  * The input a parse error carries: a bounded prefix with the full length.

package/dist/cjs/handler/limits.js

@@ -3,7 +3,7 @@
 // (ImapStream) and the standalone token parser cannot drift apart, and so the documented
 // defaults in the ImapFlowOptions type describe both paths.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createLiteralTooLargeError = exports.normalizeLimit = exports.boundedInput = exports.ERROR_CONTEXT_LENGTH = exports.MAX_RESPONSE_SIZE = exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE = void 0;
+exports.createLiteralTooLargeError = exports.normalizeLimit = exports.boundedInput = exports.ERROR_CONTEXT_LENGTH = exports.MAX_RESPONSE_TOKENS = exports.MAX_RESPONSE_SIZE = exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE = void 0;
 const errors_js_1 = require("../errors.js");
 // Maximum allowed literal size: 1GB (1073741824 bytes)
 exports.MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
@@ -21,6 +21,13 @@ exports.MAX_LINE_SIZE = exports.MAX_LITERAL_SIZE;
 // of exactly the maximum permitted size impossible to receive. Configuring both limits calls for
 // the same headroom - set maxResponseSize above maxLiteralSize, not equal to it.
 exports.MAX_RESPONSE_SIZE = 2 * exports.MAX_LITERAL_SIZE;
+// Default maximum number of tokens (atoms, strings, literals, lists and the other parse tree
+// nodes) in a single response. The byte limits bound what a server sends, not what parsing it
+// costs: every token becomes a tree node and an attribute object, around a hundred bytes of heap
+// for a two-byte "1 ", so a line of many small tokens costs fifty times its size. A legitimate
+// response stays far below this (the long one, a SEARCH answer of plain numbers, is read without
+// the tokenizer, see parser()), so the bound only stops a server that floods one response.
+exports.MAX_RESPONSE_TOKENS = 1000000;
 // How much of the offending input a parse error carries along. The error travels whole into log
 // entries (pino copies every property of a logged error) and into the rejection of the command
 // the line belonged to, and the line can be as long as the configured line cap.

package/dist/cjs/handler/token-parser.d.ts

@@ -7,7 +7,8 @@ import type { ParserInstance } from './parser-instance.js';
  * (ATOM, string, LITERAL, SEQUENCE, LIST, SECTION, PARTIAL).
  */
 export interface TokenNode {
-    childNodes: TokenNode[];
+    /** Created with the first child, a leaf token does not carry an empty array */
+    childNodes?: TokenNode[] | undefined;
     type: string | false;
     value: string | Buffer;
     isClosed: boolean;
@@ -44,6 +45,9 @@ export declare class TokenParser {
     options: ParserOptions;
     parent: TokenParserParent | ParserInstance;
     maxLiteralSize: number;
+    maxResponseTokens: number;
+    /** Nodes created so far, checked against maxResponseTokens */
+    tokenCount: number;
     tree: TokenNode;
     currentNode: TokenNode;
     pos: number;
@@ -62,6 +66,7 @@ export declare class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent: TokenParserParent | ParserInstance, startPos?: number | undefined, str?: string | null | undefined, options?: ParserOptions | undefined);
     /**
@@ -93,7 +98,8 @@ export declare class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode?: TokenNode | undefined, startPos?: number | undefined): TokenNode;
     /**

package/dist/cjs/handler/token-parser.js

@@ -45,6 +45,7 @@ class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent, startPos, str, options) {
         this.str = (str || '').toString();
@@ -53,6 +54,8 @@ class TokenParser {
         // Same normalization and default as the streaming parser, so a direct user of this parser
         // gets the same bound (an explicit 0 means "reject any non-empty inline literal").
         this.maxLiteralSize = (0, limits_js_1.normalizeLimit)(this.options.maxLiteralSize, limits_js_1.MAX_LITERAL_SIZE);
+        this.maxResponseTokens = (0, limits_js_1.normalizeLimit)(this.options.maxResponseTokens, limits_js_1.MAX_RESPONSE_TOKENS);
+        this.tokenCount = 0;
         this.truncatedAttributes = [];
         this.tree = this.currentNode = this.createNode();
         this.pos = startPos || 0;
@@ -89,7 +92,9 @@ class TokenParser {
         await this.processString();
         const attributes = [];
         let branch = attributes;
-        let walk = async (node) => {
+        // Synchronous on purpose: the recursion is bounded by MAX_NODE_DEPTH, and an async walk
+        // allocated a promise per token, which a line of many small tokens multiplies
+        let walk = (node) => {
             let curBranch = branch;
             let elm;
             let partial;
@@ -146,12 +151,16 @@ class TokenParser {
                     branch[branch.length - 1].partial = partial;
                     break;
             }
-            for (let childNode of node.childNodes) {
-                await walk(childNode);
+            // Each child is released once it is converted, so the tree and the attributes built
+            // from it are not both held whole at the peak of a line of many tokens
+            let childNodes = node.childNodes;
+            for (let i = 0; childNodes && i < childNodes.length; i++) {
+                walk(childNodes[i]);
+                childNodes[i] = null;
             }
             branch = curBranch;
         };
-        await walk(this.tree);
+        walk(this.tree);
         return attributes;
     }
     /**
@@ -162,11 +171,20 @@ class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode, startPos) {
+        // The root node is not a token of the response
+        if (parentNode && ++this.tokenCount > this.maxResponseTokens) {
+            throw (0, errors_js_1.createImapError)(`Response has more than ${this.maxResponseTokens} tokens`, 'TooManyTokens', {
+                maxSize: this.maxResponseTokens,
+                parserContext: { ...(0, limits_js_1.boundedInput)(this.str), pos: startPos }
+            });
+        }
         let node = {
-            childNodes: [],
+            // declared up front, so a node keeps one shape when its first child arrives
+            childNodes: undefined,
             type: false,
             value: '',
             isClosed: true,
@@ -199,7 +217,7 @@ class TokenParser {
             node.startPos = startPos;
         }
         if (parentNode) {
-            parentNode.childNodes.push(node);
+            (parentNode.childNodes ||= []).push(node);
         }
         return node;
     }
@@ -211,7 +229,7 @@ class TokenParser {
      */
     isFetchResponse() {
         let command = this.parent.command;
-        let first = this.tree.childNodes[0];
+        let first = this.tree.childNodes?.[0];
         return (typeof command === 'string' &&
             /^\d+$/.test(command) &&
             !!first &&
@@ -237,7 +255,7 @@ class TokenParser {
         // The item is the last child of the list while it is being parsed, so its key is the
         // child before it. A key is an atom (BODYSTRUCTURE, ENVELOPE, BODY); anything else means
         // the row itself is malformed, and the key is reported as unknown.
-        let siblings = item.parentNode ? item.parentNode.childNodes : [];
+        let siblings = item.parentNode?.childNodes || [];
         let key = siblings[siblings.length - 2];
         this.truncatedAttributes.push(key && key.type === 'ATOM' && typeof key.value === 'string' ? key.value.toUpperCase() : '?');
     }
@@ -265,13 +283,26 @@ class TokenParser {
         // character, which is quadratic in the token length, and the server decides that length:
         // a 600 KB ESEARCH result took seconds of event loop time
         let tokenLength = 0;
+        // Where the token starts in the input, and whether its value still is that run of the
+        // input. A token is read as a run of characters, so its value is sliced from the input
+        // instead of grown with +=: each += of a long token adds a cons string of some twenty
+        // bytes per character, which the server multiplies with a long token
+        let tokenStart = 0;
+        let tokenSliced = true;
+        // Where the quoted string being read starts, and whether it holds an escape
+        let stringStart = 0;
+        let stringEscaped = false;
         let tokenLast = '';
         let tokenPrev = '';
         let tokenDigitsOnly = true;
         let tokenHasStar = false;
         let tokenHasDot = false;
         const appendToToken = (c) => {
-            this.currentNode.value += c;
+            if (!tokenLength) {
+                tokenStart = i;
+            }
+            tokenSliced = tokenSliced && i === tokenStart + tokenLength && this.str.charAt(i) === c;
+            this.currentNode.value = tokenSliced ? this.str.slice(tokenStart, i + 1) : this.currentNode.value + c;
             tokenLength++;
             tokenPrev = tokenLast;
             tokenLast = c;
@@ -295,6 +326,7 @@ class TokenParser {
         const startToken = (first) => {
             this.currentNode.value = '';
             tokenLength = 0;
+            tokenSliced = true;
             tokenLast = tokenPrev = '';
             tokenDigitsOnly = true;
             tokenHasStar = tokenHasDot = false;
@@ -305,11 +337,14 @@ class TokenParser {
         // ImapStream supplies one buffer per literal marker it framed, {0} included. A marker
         // without a buffer means the line and its literals do not match up, so fail with a parser
         // error instead of reading a missing buffer or shifting every later literal by one
+        // Read by index: shift() moves every remaining buffer, which made a response of many
+        // literals quadratic to parse
+        let literalIndex = 0;
         const takeLiteral = (literals) => {
-            if (!literals.length) {
+            if (literalIndex >= literals.length) {
                 throw this.parserError(`Literal without data at position ${this.pos + i} [E35]`, 'ParserError35', this.pos + i, chr);
             }
-            return literals.shift();
+            return literals[literalIndex++];
         };
         // Any ATOM supported char starts a new Atom sequence, otherwise throw an error
         // Allow \ as the first char for atom to support system flags
@@ -336,6 +371,8 @@ class TokenParser {
                             this.currentNode = this.createNode(this.currentNode, this.pos + i);
                             this.currentNode.type = 'string';
                             this.state = STATE_STRING;
+                            stringStart = i + 1;
+                            stringEscaped = false;
                             this.currentNode.isClosed = false;
                             break;
                         // ( starts a new list
@@ -566,8 +603,11 @@ class TokenParser {
                     appendToToken(chr);
                     break;
                 case STATE_STRING:
-                    // DQUOTE ends the string sequence
+                    // DQUOTE ends the string sequence. Its value is taken from the input in one
+                    // piece, for the same reason tokens are sliced, see appendToToken()
                     if (chr === '"') {
+                        let value = this.str.slice(stringStart, i);
+                        this.currentNode.value = stringEscaped ? value.replace(/\\([\s\S])/g, '$1') : value;
                         this.currentNode.endPos = this.pos + i;
                         this.currentNode.isClosed = true;
                         this.currentNode = this.currentNode.parentNode;
@@ -575,15 +615,14 @@ class TokenParser {
                         checkSP();
                         break;
                     }
-                    // \ Escapes the following char
+                    // \ Escapes the following char, which is skipped here so it can not end the string
                     if (chr === '\\') {
                         i++;
                         if (i >= len) {
                             throw this.parserError(`Unexpected end of input at position ${this.pos + i} [E18]`, 'ParserError18', this.pos + i);
                         }
-                        chr = this.str.charAt(i);
+                        stringEscaped = true;
                     }
-                    this.currentNode.value += chr;
                     break;
                 case STATE_PARTIAL:
                     if (chr === '>') {

package/dist/cjs/handler/types.d.ts

@@ -38,8 +38,9 @@ export interface ImapResponse {
     /** Parsed attributes of the response */
     attributes?: ImapAttributeList | undefined;
     /**
-     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set instead of `attributes`
-     * when the line holds nothing else, see parser()
+     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set when the line holds
+     * nothing else but a CONDSTORE `(MODSEQ n)` list, which is then the only entry of
+     * `attributes`, see parser()
      */
     numbers?: number[] | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
@@ -79,6 +80,8 @@ export interface ParserOptions {
     literals?: Buffer[] | undefined;
     /** Maximum size in bytes of a literal parsed inline from the input */
     maxLiteralSize?: number | undefined;
+    /** Maximum number of tokens in the response, see MAX_RESPONSE_TOKENS */
+    maxResponseTokens?: number | undefined;
 }
 /**
  * One assembled response as pushed by ImapStream: the line payload, its literals and the

package/dist/cjs/imap-flow.js

@@ -870,9 +870,17 @@ class ImapFlow extends node_events_1.EventEmitter {
     async handleResponse(data) {
         let parsed;
         try {
-            parsed = await (0, imap_handler_js_1.parser)(data.payload, { literals: data.literals });
+            parsed = await (0, imap_handler_js_1.parser)(data.payload, { literals: data.literals, maxResponseTokens: this.options.maxResponseTokens });
         }
         catch (err) {
+            if (err.code === 'TooManyTokens') {
+                // A size limit, so as terminal as the ones ImapStream enforces: the server is
+                // flooding responses, and skipping the line would only invite the next one
+                this.log.error({ msg: 'Response exceeded the token limit', payloadBytes: data.payload.length, err, cid: this.id });
+                this.rejectCurrentRequest(err);
+                this.failProtocol(err);
+                return false;
+            }
             // can not make sense of this. The payload can be up to the configured line
             // cap (1GB by default), so log only a bounded prefix: a server looping
             // unparseable garbage would otherwise turn this error log into a disk filler.

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.5.8";
+export declare const version = "2.5.9";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.5.8";
+exports.version = "2.5.9";
 exports.homepage = "https://imapflow.com/";

package/dist/cjs/types.d.ts

@@ -133,8 +133,9 @@ export interface ImapFlowOptions {
      * whatever is left of `maxResponseSize`, so lowering that also bounds line buffering.
      * Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
      * no further input is parsed. The limit bounds the bytes of a line, not the memory its parse
-     * takes, which is several times the line size for a line of many small tokens. A SEARCH
-     * answer of plain numbers is read into an array of about the size of the line.
+     * takes, which is several times the line size for a line of many small tokens, see
+     * `maxResponseTokens`. A SEARCH answer of plain numbers is read into an array of about the
+     * size of the line.
      */
     maxLineLength?: number | undefined;
     /**
@@ -159,6 +160,16 @@ export interface ImapFlowOptions {
      * no further input is parsed.
      */
     maxResponseSize?: number | undefined;
+    /**
+     * Maximum number of tokens (atoms, strings, literals, lists and other parse tree nodes) in a
+     * single IMAP response. The byte limits bound what a server sends, this bounds what parsing it
+     * costs: each token takes around a hundred bytes of heap while the response is parsed, so a
+     * response of many small tokens costs about fifty times its size. Defaults to 1000000, far
+     * above any legitimate response (a SEARCH answer of plain numbers is not tokenized and does
+     * not count). Lower it in a memory-limited runtime. `Infinity` disables the limit. Exceeding it
+     * is terminal: the connection fails with error code `TooManyTokens`.
+     */
+    maxResponseTokens?: number | undefined;
     /**
      * Threshold in milliseconds for warning that a mailbox lock has been held
      * for a long time (diagnostic for forgotten release() calls). Defaults to
@@ -681,9 +692,12 @@ export type DownloadManyResult = {
 export interface AppendResponseObject {
     /** Full mailbox path where the message was uploaded to */
     destination: string;
-    /** Mailbox UIDVALIDITY if server has UIDPLUS extension enabled */
+    /** Mailbox UIDVALIDITY if server has UIDPLUS extension enabled, only set together with the `uid` it reported */
     uidValidity?: bigint | undefined;
-    /** UID of the uploaded message if server has UIDPLUS extension enabled */
+    /**
+     * UID of the uploaded message if server has UIDPLUS extension enabled. Without a usable APPENDUID,
+     * an append to the selected mailbox looks it up by sequence number instead, and `uidValidity` is not set
+     */
     uid?: number | undefined;
     /** Sequence number of the uploaded message if path is currently selected mailbox */
     seq?: number | undefined;

package/dist/esm/commands/append.js

@@ -141,11 +141,14 @@ export default async function append(connection, destination, content, flags, id
                 // message was already stored and a retrying caller would duplicate it.
                 let uidValidity = parseBigIntValue(section[1] && section[1].value, MAX_UINT32_DIGITS);
                 let uid = parseUintValue(section[2] && section[2].value, MAX_UINT32_DIGITS);
-                if (uidValidity !== false) {
-                    map.uidValidity = uidValidity;
-                }
+                // UIDVALIDITY is only reported next to the UID it was sent with: kept without one,
+                // it would end up paired with the UID the SEARCH fallback below guesses from the
+                // sequence number, and the pair would pass for a server-confirmed identity.
                 if (uid) {
                     map.uid = uid;
+                    if (uidValidity) {
+                        map.uidValidity = uidValidity;
+                    }
                 }
             }
         }

package/dist/esm/errors.d.ts

@@ -35,6 +35,7 @@ export declare const ImapFlowErrorCode: {
     readonly LineTooLarge: "LineTooLarge";
     readonly LiteralTooLarge: "LiteralTooLarge";
     readonly ResponseTooLarge: "ResponseTooLarge";
+    readonly TooManyTokens: "TooManyTokens";
     readonly TooManyResponses: "TooManyResponses";
     readonly InvalidStringValue: "InvalidStringValue";
     readonly InvalidTokenValue: "InvalidTokenValue";
@@ -117,7 +118,7 @@ export interface ImapFlowError extends Error {
     lineLength?: number | undefined;
     /** The size of a rejected response */
     responseSize?: number | undefined;
-    /** The bound that was exceeded */
+    /** The bound that was exceeded (bytes, or tokens for TooManyTokens) */
     maxSize?: number | undefined;
     /** OAuth error details from the server, for XOAUTH2 authentication failures */
     oauthError?: any;

package/dist/esm/errors.js

@@ -39,6 +39,7 @@ export const ImapFlowErrorCode = {
     LineTooLarge: 'LineTooLarge',
     LiteralTooLarge: 'LiteralTooLarge',
     ResponseTooLarge: 'ResponseTooLarge',
+    TooManyTokens: 'TooManyTokens',
     // one command received more untagged responses than are kept, see MAX_COLLECTED_RESPONSES
     TooManyResponses: 'TooManyResponses',
     // invalid values in a command

package/dist/esm/handler/imap-parser.js

@@ -3,8 +3,8 @@ import { ParserInstance } from './parser-instance.js';
 import { createImapError } from '../errors.js';
 import { boundedInput } from './limits.js';
 // The codes the parser raises on purpose: the numbered ParserErrorN codes, ParserErrorExchange,
-// the nesting limit and the inline literal size limit
-const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge)$/;
+// the nesting limit, the inline literal size limit and the token limit
+const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge|TooManyTokens)$/;
 /**
  * Anything the parser throws other than one of its own coded errors - a TypeError from a parser
  * bug, a RangeError from runaway recursion or a bad Buffer offset (which carries a Node code), a
@@ -75,6 +75,39 @@ function readSearchNumbers(str) {
     numbers.push(value);
     return numbers;
 }
+// The CONDSTORE list that ends a SEARCH answer to a MODSEQ query (RFC 7162 section 3.1.5)
+const RE_SEARCH_MODSEQ = /^ \(MODSEQ (\d{1,19})\) *$/i;
+/**
+ * Reads an untagged SEARCH response without the tokenizer, see readSearchNumbers(): the numbers,
+ * and the MODSEQ value of a trailing CONDSTORE list. A MODSEQ query on a large mailbox matches as
+ * many messages as any other, so its answer must not fall back to the tokenizer either.
+ *
+ * @param str - The rest of the line after the command
+ * @returns The numbers, with the MODSEQ list as the attributes the tokenizer would have made of
+ *   it, or null when the line is left to the tokenizer
+ */
+function readSearchResponse(str) {
+    // the last character tells whether there is a list to look for, without scanning the line
+    if (!str.trimEnd().endsWith(')')) {
+        const numbers = readSearchNumbers(str);
+        return numbers && { numbers };
+    }
+    const open = str.lastIndexOf(' (');
+    const match = open < 0 ? null : RE_SEARCH_MODSEQ.exec(str.slice(open));
+    if (!match) {
+        return null;
+    }
+    const numbers = readSearchNumbers(str.slice(0, open));
+    return (numbers && {
+        numbers,
+        attributes: [
+            [
+                { type: 'ATOM', value: 'MODSEQ' },
+                { type: 'ATOM', value: match[1] }
+            ]
+        ]
+    });
+}
 /**
  * Parses a raw IMAP command or response buffer into a structured object.
  * Handles edge cases such as null-byte-padded responses from buggy servers and
@@ -130,10 +163,9 @@ export default async function parser(command, options) {
             response.command += ' ' + (await parserInstance.getElement(imapFormalSyntax.command()));
         }
         if (response.tag === '*' && (response.command || '').toUpperCase() === 'SEARCH') {
-            const numbers = readSearchNumbers(parserInstance.remainder);
-            if (numbers) {
-                response.numbers = numbers;
-                return response;
+            const search = readSearchResponse(parserInstance.remainder);
+            if (search) {
+                return Object.assign(response, search);
             }
         }
         if (parserInstance.remainder.trim().length) {

package/dist/esm/handler/limits.d.ts

@@ -2,6 +2,7 @@ import { type ImapFlowError } from '../errors.js';
 export declare const MAX_LITERAL_SIZE: number;
 export declare const MAX_LINE_SIZE: number;
 export declare const MAX_RESPONSE_SIZE: number;
+export declare const MAX_RESPONSE_TOKENS = 1000000;
 export declare const ERROR_CONTEXT_LENGTH = 1024;
 /**
  * The input a parse error carries: a bounded prefix with the full length.

package/dist/esm/handler/limits.js

@@ -18,6 +18,13 @@ export const MAX_LINE_SIZE = MAX_LITERAL_SIZE;
 // of exactly the maximum permitted size impossible to receive. Configuring both limits calls for
 // the same headroom - set maxResponseSize above maxLiteralSize, not equal to it.
 export const MAX_RESPONSE_SIZE = 2 * MAX_LITERAL_SIZE;
+// Default maximum number of tokens (atoms, strings, literals, lists and the other parse tree
+// nodes) in a single response. The byte limits bound what a server sends, not what parsing it
+// costs: every token becomes a tree node and an attribute object, around a hundred bytes of heap
+// for a two-byte "1 ", so a line of many small tokens costs fifty times its size. A legitimate
+// response stays far below this (the long one, a SEARCH answer of plain numbers, is read without
+// the tokenizer, see parser()), so the bound only stops a server that floods one response.
+export const MAX_RESPONSE_TOKENS = 1000000;
 // How much of the offending input a parse error carries along. The error travels whole into log
 // entries (pino copies every property of a logged error) and into the rejection of the command
 // the line belonged to, and the line can be as long as the configured line cap.

package/dist/esm/handler/token-parser.d.ts

@@ -7,7 +7,8 @@ import type { ParserInstance } from './parser-instance.js';
  * (ATOM, string, LITERAL, SEQUENCE, LIST, SECTION, PARTIAL).
  */
 export interface TokenNode {
-    childNodes: TokenNode[];
+    /** Created with the first child, a leaf token does not carry an empty array */
+    childNodes?: TokenNode[] | undefined;
     type: string | false;
     value: string | Buffer;
     isClosed: boolean;
@@ -44,6 +45,9 @@ export declare class TokenParser {
     options: ParserOptions;
     parent: TokenParserParent | ParserInstance;
     maxLiteralSize: number;
+    maxResponseTokens: number;
+    /** Nodes created so far, checked against maxResponseTokens */
+    tokenCount: number;
     tree: TokenNode;
     currentNode: TokenNode;
     pos: number;
@@ -62,6 +66,7 @@ export declare class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent: TokenParserParent | ParserInstance, startPos?: number | undefined, str?: string | null | undefined, options?: ParserOptions | undefined);
     /**
@@ -93,7 +98,8 @@ export declare class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode?: TokenNode | undefined, startPos?: number | undefined): TokenNode;
     /**

package/dist/esm/handler/token-parser.js

@@ -1,6 +1,6 @@
 /* eslint new-cap: 0 */
 import imapFormalSyntax from './imap-formal-syntax.js';
-import { MAX_LITERAL_SIZE, ERROR_CONTEXT_LENGTH, boundedInput, normalizeLimit, createLiteralTooLargeError } from './limits.js';
+import { MAX_LITERAL_SIZE, MAX_RESPONSE_TOKENS, ERROR_CONTEXT_LENGTH, boundedInput, normalizeLimit, createLiteralTooLargeError } from './limits.js';
 import { createImapError } from '../errors.js';
 const STATE_ATOM = 0x001;
 const STATE_LITERAL = 0x002;
@@ -39,6 +39,7 @@ export class TokenParser {
      * @param options.literals - Pre-parsed literal values from the input stream.
      * @param options.maxLiteralSize - Maximum size (in bytes) of a literal parsed inline
      *   from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
+     * @param options.maxResponseTokens - Maximum number of parse tree nodes, see MAX_RESPONSE_TOKENS.
      */
     constructor(parent, startPos, str, options) {
         this.str = (str || '').toString();
@@ -47,6 +48,8 @@ export class TokenParser {
         // Same normalization and default as the streaming parser, so a direct user of this parser
         // gets the same bound (an explicit 0 means "reject any non-empty inline literal").
         this.maxLiteralSize = normalizeLimit(this.options.maxLiteralSize, MAX_LITERAL_SIZE);
+        this.maxResponseTokens = normalizeLimit(this.options.maxResponseTokens, MAX_RESPONSE_TOKENS);
+        this.tokenCount = 0;
         this.truncatedAttributes = [];
         this.tree = this.currentNode = this.createNode();
         this.pos = startPos || 0;
@@ -83,7 +86,9 @@ export class TokenParser {
         await this.processString();
         const attributes = [];
         let branch = attributes;
-        let walk = async (node) => {
+        // Synchronous on purpose: the recursion is bounded by MAX_NODE_DEPTH, and an async walk
+        // allocated a promise per token, which a line of many small tokens multiplies
+        let walk = (node) => {
             let curBranch = branch;
             let elm;
             let partial;
@@ -140,12 +145,16 @@ export class TokenParser {
                     branch[branch.length - 1].partial = partial;
                     break;
             }
-            for (let childNode of node.childNodes) {
-                await walk(childNode);
+            // Each child is released once it is converted, so the tree and the attributes built
+            // from it are not both held whole at the peak of a line of many tokens
+            let childNodes = node.childNodes;
+            for (let i = 0; childNodes && i < childNodes.length; i++) {
+                walk(childNodes[i]);
+                childNodes[i] = null;
             }
             branch = curBranch;
         };
-        await walk(this.tree);
+        walk(this.tree);
         return attributes;
     }
     /**
@@ -156,11 +165,20 @@ export class TokenParser {
      * @param parentNode - The parent node to attach this node to. If omitted, creates a root node.
      * @param startPos - The starting position of this node in the original input string.
      * @returns The newly created node with childNodes, type, value, and isClosed properties.
-     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item.
+     * @throws {Error} If the nesting depth exceeds MAX_NODE_DEPTH outside a FETCH data item, or
+     *   the response has more than maxResponseTokens nodes.
      */
     createNode(parentNode, startPos) {
+        // The root node is not a token of the response
+        if (parentNode && ++this.tokenCount > this.maxResponseTokens) {
+            throw createImapError(`Response has more than ${this.maxResponseTokens} tokens`, 'TooManyTokens', {
+                maxSize: this.maxResponseTokens,
+                parserContext: { ...boundedInput(this.str), pos: startPos }
+            });
+        }
         let node = {
-            childNodes: [],
+            // declared up front, so a node keeps one shape when its first child arrives
+            childNodes: undefined,
             type: false,
             value: '',
             isClosed: true,
@@ -193,7 +211,7 @@ export class TokenParser {
             node.startPos = startPos;
         }
         if (parentNode) {
-            parentNode.childNodes.push(node);
+            (parentNode.childNodes ||= []).push(node);
         }
         return node;
     }
@@ -205,7 +223,7 @@ export class TokenParser {
      */
     isFetchResponse() {
         let command = this.parent.command;
-        let first = this.tree.childNodes[0];
+        let first = this.tree.childNodes?.[0];
         return (typeof command === 'string' &&
             /^\d+$/.test(command) &&
             !!first &&
@@ -231,7 +249,7 @@ export class TokenParser {
         // The item is the last child of the list while it is being parsed, so its key is the
         // child before it. A key is an atom (BODYSTRUCTURE, ENVELOPE, BODY); anything else means
         // the row itself is malformed, and the key is reported as unknown.
-        let siblings = item.parentNode ? item.parentNode.childNodes : [];
+        let siblings = item.parentNode?.childNodes || [];
         let key = siblings[siblings.length - 2];
         this.truncatedAttributes.push(key && key.type === 'ATOM' && typeof key.value === 'string' ? key.value.toUpperCase() : '?');
     }
@@ -259,13 +277,26 @@ export class TokenParser {
         // character, which is quadratic in the token length, and the server decides that length:
         // a 600 KB ESEARCH result took seconds of event loop time
         let tokenLength = 0;
+        // Where the token starts in the input, and whether its value still is that run of the
+        // input. A token is read as a run of characters, so its value is sliced from the input
+        // instead of grown with +=: each += of a long token adds a cons string of some twenty
+        // bytes per character, which the server multiplies with a long token
+        let tokenStart = 0;
+        let tokenSliced = true;
+        // Where the quoted string being read starts, and whether it holds an escape
+        let stringStart = 0;
+        let stringEscaped = false;
         let tokenLast = '';
         let tokenPrev = '';
         let tokenDigitsOnly = true;
         let tokenHasStar = false;
         let tokenHasDot = false;
         const appendToToken = (c) => {
-            this.currentNode.value += c;
+            if (!tokenLength) {
+                tokenStart = i;
+            }
+            tokenSliced = tokenSliced && i === tokenStart + tokenLength && this.str.charAt(i) === c;
+            this.currentNode.value = tokenSliced ? this.str.slice(tokenStart, i + 1) : this.currentNode.value + c;
             tokenLength++;
             tokenPrev = tokenLast;
             tokenLast = c;
@@ -289,6 +320,7 @@ export class TokenParser {
         const startToken = (first) => {
             this.currentNode.value = '';
             tokenLength = 0;
+            tokenSliced = true;
             tokenLast = tokenPrev = '';
             tokenDigitsOnly = true;
             tokenHasStar = tokenHasDot = false;
@@ -299,11 +331,14 @@ export class TokenParser {
         // ImapStream supplies one buffer per literal marker it framed, {0} included. A marker
         // without a buffer means the line and its literals do not match up, so fail with a parser
         // error instead of reading a missing buffer or shifting every later literal by one
+        // Read by index: shift() moves every remaining buffer, which made a response of many
+        // literals quadratic to parse
+        let literalIndex = 0;
         const takeLiteral = (literals) => {
-            if (!literals.length) {
+            if (literalIndex >= literals.length) {
                 throw this.parserError(`Literal without data at position ${this.pos + i} [E35]`, 'ParserError35', this.pos + i, chr);
             }
-            return literals.shift();
+            return literals[literalIndex++];
         };
         // Any ATOM supported char starts a new Atom sequence, otherwise throw an error
         // Allow \ as the first char for atom to support system flags
@@ -330,6 +365,8 @@ export class TokenParser {
                             this.currentNode = this.createNode(this.currentNode, this.pos + i);
                             this.currentNode.type = 'string';
                             this.state = STATE_STRING;
+                            stringStart = i + 1;
+                            stringEscaped = false;
                             this.currentNode.isClosed = false;
                             break;
                         // ( starts a new list
@@ -560,8 +597,11 @@ export class TokenParser {
                     appendToToken(chr);
                     break;
                 case STATE_STRING:
-                    // DQUOTE ends the string sequence
+                    // DQUOTE ends the string sequence. Its value is taken from the input in one
+                    // piece, for the same reason tokens are sliced, see appendToToken()
                     if (chr === '"') {
+                        let value = this.str.slice(stringStart, i);
+                        this.currentNode.value = stringEscaped ? value.replace(/\\([\s\S])/g, '$1') : value;
                         this.currentNode.endPos = this.pos + i;
                         this.currentNode.isClosed = true;
                         this.currentNode = this.currentNode.parentNode;
@@ -569,15 +609,14 @@ export class TokenParser {
                         checkSP();
                         break;
                     }
-                    // \ Escapes the following char
+                    // \ Escapes the following char, which is skipped here so it can not end the string
                     if (chr === '\\') {
                         i++;
                         if (i >= len) {
                             throw this.parserError(`Unexpected end of input at position ${this.pos + i} [E18]`, 'ParserError18', this.pos + i);
                         }
-                        chr = this.str.charAt(i);
+                        stringEscaped = true;
                     }
-                    this.currentNode.value += chr;
                     break;
                 case STATE_PARTIAL:
                     if (chr === '>') {

package/dist/esm/handler/types.d.ts

@@ -38,8 +38,9 @@ export interface ImapResponse {
     /** Parsed attributes of the response */
     attributes?: ImapAttributeList | undefined;
     /**
-     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set instead of `attributes`
-     * when the line holds nothing else, see parser()
+     * The numbers of an untagged SEARCH response (`* SEARCH 2 5 9`), set when the line holds
+     * nothing else but a CONDSTORE `(MODSEQ n)` list, which is then the only entry of
+     * `attributes`, see parser()
      */
     numbers?: number[] | undefined;
     /** Number of leading NUL bytes stripped from the line, if any */
@@ -79,6 +80,8 @@ export interface ParserOptions {
     literals?: Buffer[] | undefined;
     /** Maximum size in bytes of a literal parsed inline from the input */
     maxLiteralSize?: number | undefined;
+    /** Maximum number of tokens in the response, see MAX_RESPONSE_TOKENS */
+    maxResponseTokens?: number | undefined;
 }
 /**
  * One assembled response as pushed by ImapStream: the line payload, its literals and the

package/dist/esm/imap-flow.js

@@ -827,9 +827,17 @@ export class ImapFlow extends EventEmitter {
     async handleResponse(data) {
         let parsed;
         try {
-            parsed = await parser(data.payload, { literals: data.literals });
+            parsed = await parser(data.payload, { literals: data.literals, maxResponseTokens: this.options.maxResponseTokens });
         }
         catch (err) {
+            if (err.code === 'TooManyTokens') {
+                // A size limit, so as terminal as the ones ImapStream enforces: the server is
+                // flooding responses, and skipping the line would only invite the next one
+                this.log.error({ msg: 'Response exceeded the token limit', payloadBytes: data.payload.length, err, cid: this.id });
+                this.rejectCurrentRequest(err);
+                this.failProtocol(err);
+                return false;
+            }
             // can not make sense of this. The payload can be up to the configured line
             // cap (1GB by default), so log only a bounded prefix: a server looping
             // unparseable garbage would otherwise turn this error log into a disk filler.

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.5.8";
+export declare const version = "2.5.9";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.5.8";
+export const version = "2.5.9";
 export const homepage = "https://imapflow.com/";

package/dist/esm/types.d.ts

@@ -133,8 +133,9 @@ export interface ImapFlowOptions {
      * whatever is left of `maxResponseSize`, so lowering that also bounds line buffering.
      * Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
      * no further input is parsed. The limit bounds the bytes of a line, not the memory its parse
-     * takes, which is several times the line size for a line of many small tokens. A SEARCH
-     * answer of plain numbers is read into an array of about the size of the line.
+     * takes, which is several times the line size for a line of many small tokens, see
+     * `maxResponseTokens`. A SEARCH answer of plain numbers is read into an array of about the
+     * size of the line.
      */
     maxLineLength?: number | undefined;
     /**
@@ -159,6 +160,16 @@ export interface ImapFlowOptions {
      * no further input is parsed.
      */
     maxResponseSize?: number | undefined;
+    /**
+     * Maximum number of tokens (atoms, strings, literals, lists and other parse tree nodes) in a
+     * single IMAP response. The byte limits bound what a server sends, this bounds what parsing it
+     * costs: each token takes around a hundred bytes of heap while the response is parsed, so a
+     * response of many small tokens costs about fifty times its size. Defaults to 1000000, far
+     * above any legitimate response (a SEARCH answer of plain numbers is not tokenized and does
+     * not count). Lower it in a memory-limited runtime. `Infinity` disables the limit. Exceeding it
+     * is terminal: the connection fails with error code `TooManyTokens`.
+     */
+    maxResponseTokens?: number | undefined;
     /**
      * Threshold in milliseconds for warning that a mailbox lock has been held
      * for a long time (diagnostic for forgotten release() calls). Defaults to
@@ -681,9 +692,12 @@ export type DownloadManyResult = {
 export interface AppendResponseObject {
     /** Full mailbox path where the message was uploaded to */
     destination: string;
-    /** Mailbox UIDVALIDITY if server has UIDPLUS extension enabled */
+    /** Mailbox UIDVALIDITY if server has UIDPLUS extension enabled, only set together with the `uid` it reported */
     uidValidity?: bigint | undefined;
-    /** UID of the uploaded message if server has UIDPLUS extension enabled */
+    /**
+     * UID of the uploaded message if server has UIDPLUS extension enabled. Without a usable APPENDUID,
+     * an append to the selected mailbox looks it up by sequence number instead, and `uidValidity` is not set
+     */
     uid?: number | undefined;
     /** Sequence number of the uploaded message if path is currently selected mailbox */
     seq?: number | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.5.8",
+    "version": "2.5.9",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -93,8 +93,8 @@
         "tsx": "4.23.15",
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.2",
-        "wrangler": "4.151.2"
+        "typescript-eslint": "8.72.0",
+        "wrangler": "4.151.3"
     },
     "dependencies": {
         "@zone-eu/mailsplit": "5.4.27",