mailparser 3.9.2 → 3.9.4

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.2"
+    ".": "3.9.4"
 }

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [3.9.4](https://github.com/nodemailer/mailparser/compare/v3.9.3...v3.9.4) (2026-03-09)
+
+
+### Bug Fixes
+
+* bump nodemailer to 8.0.2 for unquoted comma-in-display-name parsing ([dd71f08](https://github.com/nodemailer/mailparser/commit/dd71f0817fb229aa1ffb421b9384704e550993ca))
+* filter false values from empty References headers ([9884e5d](https://github.com/nodemailer/mailparser/commit/9884e5dd34b9dff9a45f6c205281a50d702a23b1)), closes [#385](https://github.com/nodemailer/mailparser/issues/385)
+* prevent RFC 2047 encoded-word address fabrication in decodeAddresses ([08b800c](https://github.com/nodemailer/mailparser/commit/08b800cd1c5a2ec2341ad4c7f25dc65f584b3999))
+
+## [3.9.3](https://github.com/nodemailer/mailparser/compare/v3.9.2...v3.9.3) (2026-01-28)
+
+
+### Bug Fixes
+
+* escape URLs and link text in textToHtml to prevent XSS ([921a67d](https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08)), closes [#412](https://github.com/nodemailer/mailparser/issues/412)
+
 ## [3.9.2](https://github.com/nodemailer/mailparser/compare/v3.9.1...v3.9.2) (2026-01-28)
 
 

package/lib/mail-parser.js

@@ -348,7 +348,7 @@ class MailParser extends Transform {
                     } catch (E) {
                         // ignore
                     }
-                    value = value.split(/\s+/).map(this.ensureMessageIDFormat);
+                    value = value.split(/\s+/).map(this.ensureMessageIDFormat).filter(val => val);
                     break;
                 case 'message-id':
                 case 'in-reply-to':
@@ -526,18 +526,30 @@ class MailParser extends Transform {
             address.name = (address.name || '').toString().trim();
 
             if (!address.address && /^(=\?([^?]+)\?[Bb]\?[^?]*\?=)(\s*=\?([^?]+)\?[Bb]\?[^?]*\?=)*$/.test(address.name) && !processedAddress.has(address)) {
-                let parsed = addressparser(this.libmime.decodeWords(address.name));
-                if (parsed.length) {
-                    parsed.forEach(entry => {
-                        processedAddress.add(entry);
-                        addresses.push(entry);
-                    });
-                }
+                let decoded = this.libmime.decodeWords(address.name);
+                // Security fix: only re-parse if decoded text contains angle-bracket-delimited
+                // addresses (e.g. "Name <user@domain>"). Bare decoded text like "attacker@evil.com"
+                // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
+                // encoded-words in addr-spec, and re-parsing fabricates addresses not present
+                // in the original header.
+                if (/<[^<>]+@[^<>]+>/.test(decoded)) {
+                    let parsed = addressparser(decoded);
+                    if (parsed.length) {
+                        parsed.forEach(entry => {
+                            processedAddress.add(entry);
+                            addresses.push(entry);
+                        });
+                    }
 
-                // remove current element
-                addresses.splice(i, 1);
-                i--;
-                continue;
+                    // remove current element
+                    addresses.splice(i, 1);
+                    i--;
+                    continue;
+                } else {
+                    // Treat decoded content as display name only
+                    address.name = decoded;
+                    continue;
+                }
             }
 
             if (address.name) {
@@ -547,6 +559,21 @@ class MailParser extends Transform {
                     //ignore, keep as is
                 }
             }
+            // Security fix: detect RFC 2047 encoded-words in the address field.
+            // Per RFC 2047 Section 5, encoded-words MUST NOT appear in addr-spec.
+            // If found, decode and validate; reject if result is not a simple local@domain.
+            if (address.address && /[=]\?[^?]+\?[BbQq]\?[^?]*\?[=]/.test(address.address)) {
+                try {
+                    let decodedAddr = this.libmime.decodeWords(address.address);
+                    if (/^[^\s@]+@[^\s@]+$/.test(decodedAddr) && !/[=]\?/.test(decodedAddr)) {
+                        address.address = decodedAddr;
+                    } else {
+                        address.address = '';
+                    }
+                } catch (E) {
+                    address.address = '';
+                }
+            }
             if (/@xn--/.test(address.address)) {
                 try {
                     address.address =
@@ -1129,7 +1156,11 @@ class MailParser extends Transform {
                             result.push(textPart);
                         }
 
-                        result.push(`<a href="${link.url}">${link.text}</a>`);
+                        // Escape quotes in URL to prevent XSS
+                        let safeUrl = link.url.replace(/"/g, '&quot;');
+                        // Escape HTML entities in link text
+                        let safeText = he.encode(link.text, { useNamedReferences: true });
+                        result.push(`<a href="${safeUrl}">${safeText}</a>`);
 
                         last = link.lastIndex;
                     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.2",
+    "version": "3.9.4",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -25,15 +25,15 @@
         "libmime": "5.3.7",
         "linkify-it": "5.0.0",
         "@zone-eu/mailsplit": "5.4.8",
-        "nodemailer": "7.0.13",
+        "nodemailer": "8.0.2",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
     "devDependencies": {
-        "@eslint/eslintrc": "3.3.3",
-        "@eslint/js": "9.39.2",
-        "ajv": "8.17.1",
-        "eslint": "9.39.2",
+        "@eslint/eslintrc": "3.3.5",
+        "@eslint/js": "10.0.1",
+        "ajv": "8.18.0",
+        "eslint": "10.0.3",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.1",