mailparser 3.9.29 → 3.9.30

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.29"
+    ".": "3.9.30"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [3.9.30](https://github.com/nodemailer/mailparser/compare/v3.9.29...v3.9.30) (2026-09-28)
+
+
+### Bug Fixes
+
+* cap inlined cid images, report late splitter errors, settle once, honour attachment backpressure, derive partId from the part number ([af3fe56](https://github.com/nodemailer/mailparser/commit/af3fe56719ae6bf5d867f22faf3bf81942659bdd))
+
 ## [3.9.29](https://github.com/nodemailer/mailparser/compare/v3.9.28...v3.9.29) (2026-09-27)
 
 

package/README.md

@@ -25,6 +25,11 @@ const mailparser = require('mailparser');
 
 See [mailparser homepage](https://nodemailer.com/extras/mailparser/) for documentation and terms.
 
+### Limits
+
+- `simpleParser` replaces `cid:` image references in the HTML with `data:` URLs. The total length of the URLs written into the HTML is capped by the `maxInlinedImagesSize` option (default 20 MB, counted in characters of the inserted URLs). References past the cap stay as `cid:` links. The same cap applies to URLs returned from a custom `updateImageLinks()` callback.
+- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error (for example HTML longer than `maxHtmlLengthToParse`), that error is what the caller receives. `MailParser` itself still emits the `'error'` event and then finishes parsing.
+
 ### License
 
 Licensed under MIT

package/lib/mail-parser.js

@@ -34,6 +34,16 @@ const MAX_LINKIFY_SEGMENT_LENGTH = 4096;
 const MAX_LINKIFY_HOST_LABELS = 6;
 const MAX_LINKIFY_WORK = 768 * 1024 * 1024; // shared by all text parts of a message
 
+// Default upper bound for the total length of the URLs updateImageLinks() writes
+// into the HTML (options.maxInlinedImagesSize). simpleParser inlines every cid:
+// reference as a full data: URL, so a small message repeating a reference to
+// one image thousands of times would otherwise grow the HTML past the maximum
+// string length. References beyond the budget are left as cid: links.
+const MAX_INLINED_IMAGES_SIZE = 20 * 1024 * 1024;
+
+// List-* header names that must not become keys of the plain list object
+const UNSAFE_LIST_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 linkify
     .tlds(tlds) // Reload with full tlds list
     .tlds('onion', true) // Add unofficial `.onion` domain
@@ -72,6 +82,31 @@ linkify.add('@', {
     }
 });
 
+// Linear equivalent of /<[^<>]+@[^<>]+>/.test(str). The regex backtracks
+// quadratically on a long run of @ characters after a lone <, and the input is a
+// decoded encoded-word bounded only by the header size limit.
+function hasBracketedAddress(str) {
+    let start = -1;
+    // first @ after the current < that has at least one character before it
+    let at = -1;
+    for (let i = 0, len = str.length; i < len; i++) {
+        let chr = str.charAt(i);
+        if (chr === '<') {
+            start = i;
+            at = -1;
+        } else if (chr === '>') {
+            if (start >= 0 && at >= 0 && at < i - 1) {
+                return true;
+            }
+            start = -1;
+            at = -1;
+        } else if (chr === '@' && start >= 0 && at < 0 && i > start + 1) {
+            at = i;
+        }
+    }
+    return false;
+}
+
 class IconvDecoder extends Transform {
     constructor(Iconv, charset) {
         super();
@@ -185,8 +220,6 @@ class MailParser extends Transform {
 
         this.attachmentList = [];
 
-        this.boundaries = [];
-
         this.textTypes = ['text/plain', 'text/html'].concat(!this.options.keepDeliveryStatus ? 'message/delivery-status' : []);
 
         this.decoder = this.getDecoder();
@@ -236,7 +269,7 @@ class MailParser extends Transform {
                 decodeStream(charset) {
                     // resolve charset aliases (eg. iso-8859-8-i -> ISO-8859-8) via libmime's canonical table
                     charset = libmime.normalizeCharset((charset || 'ascii').toString());
-                    if (/^jis|^iso-?2022-?jp|^EUCJP/i.test(charset)) {
+                    if (/^jis|^iso-?2022-?jp/i.test(charset)) {
                         // special case not supported by iconv-lite
                         return new JPDecoder(charset);
                     }
@@ -302,7 +335,12 @@ class MailParser extends Transform {
         if (this.finished) {
             return this.cleanup(done);
         }
-        this.waitingEnd = () => {
+        this.waitingEnd = err => {
+            // runs once, either on a splitter error after end of input or when the splitter ends
+            this.waitingEnd = false;
+            if (err) {
+                return done(err);
+            }
             this.cleanup(done);
         };
     }
@@ -479,6 +517,10 @@ class MailParser extends Transform {
     }
 
     parseListHeader(key, value) {
+        if (UNSAFE_LIST_KEYS.has(key)) {
+            // would replace the prototype of (or shadow) the normalized list object
+            return false;
+        }
         let addresses = addressparser(value);
         let response = {};
         let data = addresses
@@ -563,7 +605,7 @@ class MailParser extends Transform {
                 // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
                 // encoded-words in addr-spec, and re-parsing fabricates addresses not present
                 // in the original header.
-                if (/<[^<>]+@[^<>]+>/.test(decoded)) {
+                if (hasBracketedAddress(decoded)) {
                     let parsed = addressparser(decoded);
                     if (parsed.length) {
                         parsed.forEach(entry => {
@@ -852,7 +894,8 @@ class MailParser extends Transform {
     processChunk(data, done) {
         let partId = null;
         if (data._parentBoundary) {
-            partId = this._getPartId(data._parentBoundary);
+            // mailsplit numbers parts IMAP style from the actual tree, TEXT markers are not part of the id
+            partId = (data.partNr || []).filter(nr => typeof nr === 'number').join('.') || null;
         }
         switch (data.type) {
             case 'node': {
@@ -884,6 +927,11 @@ class MailParser extends Transform {
                         contentType = this.libmime.detectMimeType(data.filename) || 'application/octet-stream';
                     }
 
+                    // backpressure state for the attachment stream, see pump() below
+                    let released = false;
+                    let waitingDrain = false;
+                    let pump = null;
+
                     let attachment = {
                         type: 'attachment',
                         content: null,
@@ -891,6 +939,11 @@ class MailParser extends Transform {
                         partId,
                         release: () => {
                             attachment.release = null;
+                            released = true;
+                            if (waitingDrain) {
+                                waitingDrain = false;
+                                pump();
+                            }
                             if (this.waitUntilAttachmentEnd && typeof this.attachmentCallback === 'function') {
                                 setImmediate(this.attachmentCallback);
                             }
@@ -905,11 +958,25 @@ class MailParser extends Transform {
                         hasher.emit('error', err);
                     });
 
-                    node.decoder.on('readable', () => {
+                    // Honour the consumer's backpressure while it reads the attachment. Once the
+                    // attachment is released it is drained regardless, so that a caller that
+                    // releases without reading the content does not stall the parser.
+                    pump = () => {
                         let chunk;
-
                         while ((chunk = node.decoder.read()) !== null) {
-                            hasher.write(chunk);
+                            if (hasher.write(chunk) === false && !released) {
+                                waitingDrain = true;
+                                return hasher.once('drain', () => {
+                                    waitingDrain = false;
+                                    pump();
+                                });
+                            }
+                        }
+                    };
+
+                    node.decoder.on('readable', () => {
+                        if (!waitingDrain) {
+                            pump();
                         }
                     });
 
@@ -1041,22 +1108,6 @@ class MailParser extends Transform {
         setImmediate(done);
     }
 
-    _getPartId(parentBoundary) {
-        let boundaryIndex = this.boundaries.findIndex(item => item.name === parentBoundary);
-        if (boundaryIndex === -1) {
-            this.boundaries.push({ name: parentBoundary, count: 1 });
-            boundaryIndex = this.boundaries.length - 1;
-        } else {
-            this.boundaries[boundaryIndex].count++;
-        }
-        let partId = '1';
-        for (let i = 0; i <= boundaryIndex; i++) {
-            if (i === 0) partId = this.boundaries[i].count.toString();
-            else partId += '.' + this.boundaries[i].count.toString();
-        }
-        return partId;
-    }
-
     getAddressesHTML(value) {
         let formatSingleLevel = addresses =>
             addresses
@@ -1139,12 +1190,28 @@ class MailParser extends Transform {
         let pos = 0;
         let processNext = () => {
             if (pos >= cidList.length) {
-                html = html.replace(/\bcid:([^'"\s]{1,256})/g, (match, cid) => {
-                    if (cids.has(cid) && cids.get(cid).url) {
-                        return cids.get(cid).url;
-                    }
-                    return match;
-                });
+                let maxSize = this.options.maxInlinedImagesSize;
+                if (typeof maxSize !== 'number' || !(maxSize >= 0)) {
+                    maxSize = MAX_INLINED_IMAGES_SIZE;
+                }
+                let inlinedSize = 0;
+                try {
+                    html = html.replace(/\bcid:([^'"\s]{1,256})/g, (match, cid) => {
+                        let url = cids.has(cid) && cids.get(cid).url;
+                        if (!url) {
+                            return match;
+                        }
+                        url = String(url);
+                        if (inlinedSize + url.length > maxSize) {
+                            return match;
+                        }
+                        inlinedSize += url.length;
+                        return url;
+                    });
+                } catch (err) {
+                    // runs from setImmediate, a throw here would be an uncaught exception
+                    return done(err);
+                }
 
                 return done(null, html);
             }

package/lib/simple-parser.js

@@ -19,6 +19,18 @@ module.exports = (input, options, callback) => {
         });
     }
 
+    // MailParser may emit a non-fatal 'error' (eg. HTML too long to convert to text) and
+    // still reach 'end', so settle only once: the first error or the result wins
+    let settled = false;
+    let settle = callback;
+    callback = (...args) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        settle(...args);
+    };
+
     options = options || {};
     let keepCidLinks = !!options.keepCidLinks;
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.29",
+    "version": "3.9.30",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -22,10 +22,10 @@
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
-        "libmime": "5.4.4",
+        "libmime": "5.4.5",
         "linkify-it": "5.0.2",
-        "@zone-eu/mailsplit": "5.4.17",
-        "nodemailer": "10.0.11",
+        "@zone-eu/mailsplit": "5.4.18",
+        "nodemailer": "10.0.12",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },