mailparser 3.9.15 → 3.9.16

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.15"
+    ".": "3.9.16"
 }

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [3.9.16](https://github.com/nodemailer/mailparser/compare/v3.9.15...v3.9.16) (2026-08-24)
+
+
+### Bug Fixes
+
+* bound linkify-it scanning of untrusted text bodies ([1910471](https://github.com/nodemailer/mailparser/commit/1910471a4edd72249237ce7ad243228d61c4908f))
+* **deps:** update html-to-text to 10.0.1 ([308e1b2](https://github.com/nodemailer/mailparser/commit/308e1b2993e554470ecbd3570cdd18a394b866b3))
+
 ## [3.9.15](https://github.com/nodemailer/mailparser/compare/v3.9.14...v3.9.15) (2026-08-07)
 
 

package/lib/mail-parser.js

@@ -16,6 +16,24 @@ const linkify = require('linkify-it')();
 const tlds = require('tlds');
 const encodingJapanese = require('encoding-japanese');
 
+// Bounds for link detection in text bodies. Message content is untrusted and
+// linkify-it backtracks heavily on crafted input: matching a host is quadratic
+// in the length of a single whitespace-free run and exponential in the number
+// of dot separated labels it has to try (a label starting with "xn--" matches
+// two of the alternatives in linkify-it's domain pattern, so N such labels can
+// be grouped in 2^N ways). Text is therefore scanned one whitespace-delimited
+// segment at a time, segments long enough or with enough chained host labels to
+// get expensive are left as plain text, and a message may only spend so much
+// work in total. Scanning one segment costs roughly length * (length + 1024), so
+// the budget is counted in those units rather than in characters - neither a
+// few very long segments nor very many short ones can then add up to an
+// unbounded scan. Together these keep the worst case at about half a second.
+// Ordinary mail stays far below all three: across test/fixtures the longest
+// segment is 565 characters and 99.9% of them chain up at most 3 host labels.
+const MAX_LINKIFY_SEGMENT_LENGTH = 4096;
+const MAX_LINKIFY_HOST_LABELS = 6;
+const MAX_LINKIFY_WORK = 768 * 1024 * 1024; // shared by all text parts of a message
+
 linkify
     .tlds(tlds) // Reload with full tlds list
     .tlds('onion', true) // Add unofficial `.onion` domain
@@ -23,6 +41,13 @@ linkify
     .add('ftp:', null) // Disable `ftp:` ptotocol
     .set({ fuzzyIP: true, fuzzyLink: true, fuzzyEmail: true });
 
+// Characters linkify-it accepts inside a host name: letters, digits, a dash,
+// and anything non-ASCII (its label pattern takes any character that is not
+// punctuation, whitespace or a control character).
+function isHostChar(code) {
+    return (code >= 0x61 && code <= 0x7a) || (code >= 0x41 && code <= 0x5a) || (code >= 0x30 && code <= 0x39) || code === 0x2d || code >= 0x80;
+}
+
 // twitter linkifier from
 // https://github.com/markdown-it/linkify-it#example-2-add-twitter-mentions-handler
 linkify.add('@', {
@@ -35,7 +60,7 @@ linkify.add('@', {
         if (self.re.twitter.test(tail)) {
             // Linkifier allows punctuation chars before prefix,
             // but we additionally disable `@` ("@@mention" is invalid)
-            if (pos >= 2 && tail[pos - 2] === '@') {
+            if (pos >= 2 && text[pos - 2] === '@') {
                 return false;
             }
             return tail.match(self.re.twitter)[0].length;
@@ -156,6 +181,7 @@ class MailParser extends Transform {
         this.text = false;
         this.html = false;
         this.textAsHtml = false;
+        this.linkifyWork = 0;
 
         this.attachmentList = [];
 
@@ -277,9 +303,7 @@ class MailParser extends Transform {
             return this.cleanup(done);
         }
         this.waitingEnd = () => {
-            this.cleanup(() => {
-                done();
-            });
+            this.cleanup(done);
         };
     }
 
@@ -289,7 +313,8 @@ class MailParser extends Transform {
                 let t = this.getTextContent();
                 this.push(t);
             } catch (err) {
-                return this.emit('error', err);
+                // report through the stream instead of leaving _flush hanging
+                return done(err);
             }
 
             done();
@@ -351,7 +376,10 @@ class MailParser extends Transform {
                     } catch (E) {
                         // ignore
                     }
-                    value = value.split(/\s+/).map(this.ensureMessageIDFormat).filter(val => val);
+                    value = value
+                        .split(/\s+/)
+                        .map(this.ensureMessageIDFormat)
+                        .filter(val => val);
                     break;
                 case 'message-id':
                 case 'in-reply-to':
@@ -1133,6 +1161,73 @@ class MailParser extends Transform {
         setImmediate(processNext);
     }
 
+    // Tells whether a text segment is worth handing to linkify-it, see
+    // MAX_LINKIFY_* above. Note that linkify.pretest() can not be used for this
+    // - it is a quick deny that also denies links its own matcher finds, eg. a
+    // host followed by a fullwidth vertical bar.
+    canScanSegment(segment) {
+        // every link linkify-it can find contains at least one of these
+        if (segment.length > MAX_LINKIFY_SEGMENT_LENGTH || !/[.:@/]/.test(segment)) {
+            return false;
+        }
+
+        // Dots only chain up into one host candidate while the characters
+        // around them could be part of a host, so a slash, comma or colon ends
+        // the chain and dots in a path or query do not add to it.
+        let labels = 0;
+        for (let i = 0, len = segment.length; i < len; i++) {
+            let code = segment.charCodeAt(i);
+            if (code === 0x2e) {
+                if (++labels > MAX_LINKIFY_HOST_LABELS) {
+                    return false;
+                }
+            } else if (!isHostChar(code)) {
+                labels = 0;
+            }
+        }
+
+        return true;
+    }
+
+    findLinks(str) {
+        let links = [];
+
+        if (this.linkifyWork >= MAX_LINKIFY_WORK || !linkify.pretest(str)) {
+            return links;
+        }
+
+        // Whitespace can not be part of a link and linkify-it treats the end of
+        // a segment exactly like whitespace, so scanning segment by segment
+        // finds the same links as scanning the entire string would. U+FEFF is
+        // whitespace for Javascript but an ordinary link character for
+        // linkify-it, so it must not end a segment.
+        let segmentRegex = /[\S\uFEFF]+/g;
+        let segmentMatch;
+
+        while ((segmentMatch = segmentRegex.exec(str)) !== null) {
+            let segment = segmentMatch[0];
+
+            if (!this.canScanSegment(segment)) {
+                // too expensive to scan or can not match at all, keep as plain text
+                continue;
+            }
+
+            let matches = linkify.match(segment);
+            for (let i = 0; matches && i < matches.length; i++) {
+                matches[i].index += segmentMatch.index;
+                matches[i].lastIndex += segmentMatch.index;
+                links.push(matches[i]);
+            }
+
+            this.linkifyWork += segment.length * (segment.length + 1024);
+            if (this.linkifyWork >= MAX_LINKIFY_WORK) {
+                break;
+            }
+        }
+
+        return links;
+    }
+
     textToHtml(str) {
         if (this.options.skipTextToHtml) {
             return '';
@@ -1140,12 +1235,10 @@ class MailParser extends Transform {
         str = (str || '').toString();
         let encoded;
 
-        let linkified = false;
         if (!this.options.skipTextLinks) {
             try {
-                if (linkify.pretest(str)) {
-                    linkified = true;
-                    let links = linkify.match(str) || [];
+                let links = this.findLinks(str);
+                if (links.length) {
                     let result = [];
                     let last = 0;
 
@@ -1182,7 +1275,8 @@ class MailParser extends Transform {
             }
         }
 
-        if (!linkified) {
+        // nothing linkified, or linkifying threw halfway through
+        if (!encoded) {
             encoded = he
                 // encode special chars
                 .encode(str, {
@@ -1195,7 +1289,12 @@ class MailParser extends Transform {
             encoded
                 .replace(/\r?\n/g, '\n')
                 .trim() // normalize line endings
-                .replace(/[ \t]+$/gm, '')
+                // Trims trailing spaces and tabs off every line. The leading
+                // group keeps this linear, plain /[ \t]+$/gm rescans the whole
+                // run from every position inside it, which is quadratic. The
+                // lookahead lists the line terminators that multiline $ matches
+                // before, the group covers the line starts.
+                .replace(/(^|[^ \t])[ \t]+(?=[\n\r\u2028\u2029]|$)/g, '$1')
                 .trim() // trim empty line endings
                 .replace(/\n\n+/g, '</p><p>')
                 .trim() // insert <p> to multiple linebreaks

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.15",
+    "version": "3.9.16",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -20,7 +20,7 @@
     "dependencies": {
         "encoding-japanese": "2.2.0",
         "he": "1.2.0",
-        "html-to-text": "10.0.0",
+        "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
         "libmime": "5.4.2",
         "linkify-it": "5.0.2",
@@ -33,7 +33,7 @@
         "@eslint/eslintrc": "3.3.6",
         "@eslint/js": "10.0.1",
         "ajv": "8.20.0",
-        "eslint": "10.8.0",
+        "eslint": "10.9.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.3",