mailparser 3.9.38 → 3.9.40

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.38"
+    ".": "3.9.40"
 }

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [3.9.40](https://github.com/nodemailer/mailparser/compare/v3.9.39...v3.9.40) (2026-10-16)
+
+
+### Bug Fixes
+
+* bump @zone-eu/mailsplit to 5.4.23 ([32adf4f](https://github.com/nodemailer/mailparser/commit/32adf4f9b7d10a95f98359de7476ebb7fe526cf0))
+* bump libmime to 5.4.9 and nodemailer to 10.1.2 ([a928892](https://github.com/nodemailer/mailparser/commit/a92889221c11eb81b06472f911672b71c288c4ef))
+* keep the message when its HTML can not be converted to text, and never turn a decoded display name into an address ([0d234fd](https://github.com/nodemailer/mailparser/commit/0d234fd3ab1207a617e3682b27c72f4902d76936))
+
+## [3.9.39](https://github.com/nodemailer/mailparser/compare/v3.9.38...v3.9.39) (2026-10-14)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 10.1.1, libmime to 5.4.8 and mailsplit to 5.4.21 ([43ddf3e](https://github.com/nodemailer/mailparser/commit/43ddf3e9214b2a14b20319d1679ffe001a3a6889))
+
 ## [3.9.38](https://github.com/nodemailer/mailparser/compare/v3.9.37...v3.9.38) (2026-10-10)
 
 

package/README.md

@@ -28,7 +28,8 @@ See [mailparser homepage](https://nodemailer.com/extras/mailparser/) for documen
 ### Limits
 
 - `simpleParser` replaces `cid:` image references in the HTML with `data:` URLs. The total length of the URLs written into the HTML is capped by the `maxInlinedImagesSize` option (default 20 MB, counted in characters of the inserted URLs). References past the cap stay as `cid:` links. The same cap applies to URLs returned from a custom `updateImageLinks()` callback.
-- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error (for example HTML longer than `maxHtmlLengthToParse`), that error is what the caller receives. `MailParser` itself still emits the `'error'` event and then finishes parsing.
+- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error and then finishes parsing, that error is what the caller receives.
+- HTML that can not be converted to text (longer than `maxHtmlLengthToParse`, nested deeper than 1000 levels, or rejected by html-to-text) does not fail the message. `text` is empty, `html` is kept, and the reason is set as `textConversionError` on the result (and on the `text` object `MailParser` emits).
 
 ### License
 

package/SECURITY.md

@@ -3,21 +3,24 @@
 mailparser is an email parsing library for Node.js. It is routinely pointed at
 untrusted, adversarial, and malformed messages, so parser robustness is a
 security concern: a crafted message should never be able to crash the host
-process, exhaust memory or CPU, pollute prototypes, or leak data across parses.
-We take security reports seriously and aim to respond quickly.
+process, exhaust memory or CPU through amplification, pollute prototypes, or
+leak data across parses. We welcome responsible reports of vulnerabilities that
+present a credible security risk to users. Please distinguish security
+vulnerabilities from ordinary bugs, unusual edge cases, and hardening
+suggestions.
 
 ## Supported Versions
 
-Security fixes are released only against the latest version. We do not backport
-patches to older releases - upgrading to the current 3.x release line is the
-supported way to receive security updates.
+Security fixes are released only against the latest major version. We do not
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
 | 3.x     | :white_check_mark: |
 | < 3.0   | :x:                |
 
-If you are on an older version, please upgrade. See the release notes at
+If you are on an older major, please upgrade. See the release notes at
 <https://github.com/nodemailer/mailparser/releases> before updating.
 
 > [!NOTE]
@@ -26,51 +29,126 @@ If you are on an older version, please upgrade. See the release notes at
 > [PostalMime](https://github.com/postalsys/postal-mime), which works in both
 > Node.js and browser environments.
 
-## Reporting a Vulnerability
+## What Qualifies as a Security Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues,
-pull requests, or discussions.**
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of mailparser. Unexpected behavior, a
+failing test, or a technically correct proof of concept is not sufficient on its
+own to establish security impact.
 
-Report privately through one of the following channels:
+In particular, explain:
 
-1. **GitHub Security Advisories (preferred).** Open a private report at
-   <https://github.com/nodemailer/mailparser/security/advisories/new>. This keeps
-   the discussion private until a fix is published and lets us credit you.
-2. **Email.** Send details to **andris@postalsys.com** (the contact listed in
-   [`SECURITY.txt`](SECURITY.txt)). Encrypt sensitive details if possible - our
-   PGP key fingerprint is `5D952A46E1D8C931F6364E01DC6C83F4D584D364`.
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported public API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain why
+  those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
 
-When reporting, please include as much of the following as you can:
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
 
-- The affected version(s) and environment (mailparser version, Node.js version,
-  OS).
-- A clear description of the issue and its impact (e.g. denial of service via
-  CPU or memory exhaustion, ReDoS, prototype pollution, unhandled exception that
-  crashes the process, information disclosure between parses).
-- A minimal proof of concept - ideally the raw `.eml` sample or a short script
-  that reproduces the issue.
-- Any suggested remediation, if you have one.
+## Reporting a Vulnerability
 
-We are a small team, so there is no guaranteed response time - sometimes reports
-are handled within hours, sometimes they take longer. Accepted issues are fixed
-in a new release and coordinated through a GitHub Security Advisory, and
-reporters who wish to be named are credited.
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the
+maintainers.**
 
-## CVEs
+Report privately through one of the following channels:
 
-We track and disclose vulnerabilities through GitHub Security Advisories. We do
-not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself - for example, through GitHub's own
-CVE request flow on the published advisory, or another CNA.
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/nodemailer/mailparser/security/advisories/new>.
+2. **Email:** **andris@postalsys.com**, as listed in
+   [`SECURITY.txt`](SECURITY.txt). Encrypt sensitive details if possible.
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected mailparser version or commit, Node.js version, and relevant
+   configuration.
+2. A concise description of the issue and the affected public API or code path
+   (`MailParser` or `simpleParser`. The raw `.eml` sample that triggers the
+   issue is the most useful reproduction).
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects real deployments beyond a
+   deliberately constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of
+exploitability. A complete real-world exploit is not always necessary, but the
+report must make a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside mailparser's control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+mailparser is maintained by a small team, and there is **no guaranteed response
+or resolution time**. Reports are prioritized based on demonstrated impact,
+exploitability, affected usage, and available maintenance resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainers.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that mailparser
+has confirmed a security vulnerability or endorsed a CVE assignment. We do not
+guarantee advisories, CVE identifiers, or public credit for reports. For
+confirmed vulnerabilities disclosed through an advisory, substantive reporters
+may be credited if they wish.
 
 ## Scope
 
-In scope: the mailparser library source in this repository - the streaming MIME
+In scope: the mailparser library source in this repository: the streaming MIME
 parser (`MailParser`), the convenience parser (`simpleParser`), header and
-address decoding, charset/transfer-encoding handling, and attachment and HTML/
-text extraction. Of particular interest are inputs that cause unbounded resource
-consumption, catastrophic regular-expression backtracking, prototype pollution,
-or process crashes.
+address decoding, charset and transfer-encoding handling, and attachment and
+HTML/text extraction. Of particular interest are small crafted inputs that cause
+amplified resource consumption, catastrophic regular-expression backtracking,
+prototype pollution, or process crashes.
 
 Out of scope:
 
@@ -78,13 +156,11 @@ Out of scope:
   Parsed email content is attacker-controlled data; you must sanitize and escape
   it before rendering, storing, or executing it. In particular, the `html` field
   is not sanitized for safe display in a browser.
-- Vulnerabilities in third-party dependencies that are already tracked and fixed
-  upstream - report those to the respective project (we will still bump the
-  dependency once a fix is available).
-- Issues that require an already-compromised host or a malicious local
-  environment.
 - Resource consumption that is proportional to a legitimately large input (for
   example, parsing a genuine 100MB message uses memory) rather than amplified by
   a crafted small input.
+- Vulnerabilities in third-party dependencies that are already tracked upstream
+  (we will still bump the dependency once a fix is available).
+- Social-engineering reports.
 
 Thank you for helping keep mailparser and its users safe.

package/lib/mail-parser.js

@@ -82,27 +82,121 @@ linkify.add('@', {
     }
 });
 
-// Linear equivalent of /<[^<>]+@[^<>]+>/.test(str). The regex backtracks
-// quadratically on a long run of @ characters after a lone <, and the input is a
-// decoded encoded-word bounded only by the header size limit.
-function hasBracketedAddress(str) {
-    let start = -1;
-    // first @ after the current < that has at least one character before it
-    let at = -1;
-    for (let i = 0, len = str.length; i < len; i++) {
-        let chr = str.charAt(i);
-        if (chr === '<') {
-            start = i;
-            at = -1;
-        } else if (chr === '>') {
-            if (start >= 0 && at >= 0 && at < i - 1) {
-                return true;
+// Lists the parameters a header value gives in RFC 2231 form (name*=, name*0= or
+// name*0*=). libmime decodes those while parsing the header, so the result must not go
+// through decodeWords as well: filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D would
+// otherwise come out as "a.exe" while a parser that decodes once sees the encoded word.
+function rfc2231ParamNames(value) {
+    let names = new Set();
+    let quote = false;
+    let escaped = false;
+    let start = 0;
+
+    let addSegment = end => {
+        let segment = value.substring(start, end);
+        let eq = segment.indexOf('=');
+        if (eq < 0) {
+            return;
+        }
+        let match = segment
+            .substring(0, eq)
+            .trim()
+            .toLowerCase()
+            .match(/^(.+?)\*(\d+\*?)?$/);
+        if (match) {
+            names.add(match[1]);
+        }
+    };
+
+    for (let i = 0; i < value.length; i++) {
+        let chr = value.charAt(i);
+        if (escaped) {
+            escaped = false;
+        } else if (chr === '\\') {
+            escaped = true;
+        } else if (chr === '"') {
+            quote = !quote;
+        } else if (chr === ';' && !quote) {
+            addSegment(i);
+            start = i + 1;
+        }
+    }
+    addSegment(value.length);
+
+    return names;
+}
+
+// Deepest element nesting html-to-text is asked to convert. htmlparser2 keeps its open
+// element stack at the front of an array, so parsing alone is quadratic in the nesting
+// depth (200k nested <b> took 9 s), and html-to-text's recursive walk overflows the call
+// stack at about 2000 levels. Real markup stays far below this: Chrome's own parser
+// flattens anything nested deeper than 512 levels.
+const MAX_HTML_NESTING_DEPTH = 1000;
+
+// Elements that never hold content, so a start tag does not open a level
+const HTML_VOID_ELEMENTS = new Set(['area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source', 'track', 'wbr']);
+
+// Elements the HTML parser closes implicitly when a sibling opens (li after li, td after
+// td, p after p), so an unclosed run of them does not nest. They are left out of the depth
+// count: a report with thousands of unclosed table cells is sloppy but common markup
+const HTML_IMPLIED_END_ELEMENTS = new Set(['p', 'li', 'dt', 'dd', 'option', 'optgroup', 'tr', 'td', 'th', 'thead', 'tbody', 'tfoot', 'rt', 'rp']);
+
+function isTagNameChar(code) {
+    return (
+        (code >= 0x61 && code <= 0x7a) || (code >= 0x41 && code <= 0x5a) || (code >= 0x30 && code <= 0x39) || code === 0x2d || code === 0x3a || code === 0x5f
+    );
+}
+
+// Reports whether `html` nests elements deeper than `maxDepth`, in one linear pass that
+// follows what htmlparser2 builds: a start tag opens an element (a trailing "/" does not
+// close it in HTML mode), an end tag closes down to the nearest open element of that name
+// and is ignored otherwise, comments are skipped. Returns as soon as the limit is crossed.
+function exceedsHtmlNestingDepth(html, maxDepth) {
+    let stack = [];
+    let open = new Map(); // element name -> how many of them are on the stack
+    let len = html.length;
+    let i = html.indexOf('<');
+    while (i >= 0) {
+        let pos = i + 1;
+        if (html.startsWith('!--', pos)) {
+            let end = html.indexOf('-->', pos + 3);
+            i = end < 0 ? -1 : html.indexOf('<', end + 3);
+            continue;
+        }
+        let closing = html.charCodeAt(pos) === 0x2f; // "/"
+        if (closing) {
+            pos++;
+        }
+        let nameStart = pos;
+        while (pos < len && isTagNameChar(html.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos === nameStart) {
+            // not a tag, "<" is text here
+            i = html.indexOf('<', pos);
+            continue;
+        }
+        let name = html.slice(nameStart, pos).toLowerCase();
+        let end = html.indexOf('>', pos);
+        if (end < 0) {
+            break;
+        }
+        if (!HTML_VOID_ELEMENTS.has(name) && !HTML_IMPLIED_END_ELEMENTS.has(name)) {
+            if (!closing) {
+                stack.push(name);
+                open.set(name, (open.get(name) || 0) + 1);
+                if (stack.length > maxDepth) {
+                    return true;
+                }
+            } else if (open.get(name)) {
+                let popped;
+                do {
+                    popped = stack.pop();
+                    open.set(popped, open.get(popped) - 1);
+                } while (popped !== name);
             }
-            start = -1;
-            at = -1;
-        } else if (chr === '@' && start >= 0 && at < 0 && i > start + 1) {
-            at = i;
         }
+        i = html.indexOf('<', end + 1);
     }
     return false;
 }
@@ -379,12 +473,17 @@ class MailParser extends Transform {
             switch (key) {
                 case 'content-type':
                 case 'content-disposition':
-                case 'dkim-signature':
+                case 'dkim-signature': {
+                    // a parameter given in RFC 2231 form is decoded by parseHeaderValue already
+                    let rfc2231 = rfc2231ParamNames(value);
                     value = this.libmime.parseHeaderValue(value);
                     if (value.value) {
                         value.value = this.libmime.decodeWords(value.value);
                     }
                     Object.keys((value && value.params) || {}).forEach(key => {
+                        if (rfc2231.has(key)) {
+                            return;
+                        }
                         try {
                             value.params[key] = this.libmime.decodeWords(value.params[key]);
                         } catch (E) {
@@ -392,6 +491,7 @@ class MailParser extends Transform {
                         }
                     });
                     break;
+                }
                 case 'date': {
                     let dateValue = new Date(value);
                     if (isNaN(dateValue)) {
@@ -464,7 +564,12 @@ class MailParser extends Transform {
                 if (!headers.has(key)) {
                     headers.set(key, [].concat(value || []));
                 } else if (Array.isArray(value)) {
-                    headers.set(key, headers.get(key).concat(value));
+                    // appended in place: rebuilding the list with concat for every repeated
+                    // header was quadratic in the number of References lines
+                    let list = headers.get(key);
+                    for (let entry of value) {
+                        list.push(entry);
+                    }
                 } else {
                     headers.get(key).push(value);
                 }
@@ -495,7 +600,9 @@ class MailParser extends Transform {
         headers.forEach((value, key) => {
             if (Array.isArray(value)) {
                 if (singleKeys.includes(key) && value.length) {
-                    headers.set(key, value[value.length - 1]);
+                    // the first occurrence: the one mailsplit built the MIME structure from,
+                    // and the one mail clients display when the header is duplicated
+                    headers.set(key, value[0]);
                 } else if (value.length === 1) {
                     headers.set(key, value[0]);
                 }
@@ -593,38 +700,14 @@ class MailParser extends Transform {
     }
 
     decodeAddresses(addresses) {
-        let processedAddress = new WeakSet();
         for (let i = 0; i < addresses.length; i++) {
             let address = addresses[i];
             address.name = (address.name || '').toString().trim();
 
-            if (!address.address && /^(=\?([^?]+)\?[Bb]\?[^?]*\?=)(\s*=\?([^?]+)\?[Bb]\?[^?]*\?=)*$/.test(address.name) && !processedAddress.has(address)) {
-                let decoded = this.libmime.decodeWords(address.name);
-                // Security fix: only re-parse if decoded text contains angle-bracket-delimited
-                // addresses (e.g. "Name <user@domain>"). Bare decoded text like "attacker@evil.com"
-                // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
-                // encoded-words in addr-spec, and re-parsing fabricates addresses not present
-                // in the original header.
-                if (hasBracketedAddress(decoded)) {
-                    let parsed = addressparser(decoded);
-                    if (parsed.length) {
-                        parsed.forEach(entry => {
-                            processedAddress.add(entry);
-                            addresses.push(entry);
-                        });
-                    }
-
-                    // remove current element
-                    addresses.splice(i, 1);
-                    i--;
-                    continue;
-                } else {
-                    // Treat decoded content as display name only
-                    address.name = decoded;
-                    continue;
-                }
-            }
-
+            // An encoded word decodes into the display name and nothing else, whatever it
+            // decodes to. RFC 2047 section 5 keeps encoded words out of the addr-spec, so a
+            // name that decodes to "CEO" <ceo@bank.com> is still only a name: parsing it
+            // again would report an address the header never carried
             if (address.name) {
                 try {
                     address.name = this.libmime.decodeWords(address.name);
@@ -762,6 +845,7 @@ class MailParser extends Transform {
     getTextContent() {
         let text = [];
         let html = [];
+        let textConversionError = null;
         let processNode = (alternative, level, node) => {
             if (node.showMeta) {
                 let meta = ['From', 'Subject', 'Date', 'To', 'Cc', 'Bcc']
@@ -845,27 +929,34 @@ class MailParser extends Transform {
                         html.push(this.textToHtml(node.textContent));
                     }
                 } else if (node.contentType === 'text/html') {
-                    let failedToParseHtml = false;
                     if ((!alternative && this.hasText) || (node.root && !this.hasText)) {
                         if (this.options.skipHtmlToText) {
                             text.push('');
-                        } else if (node.textContent.length > this.options.maxHtmlLengthToParse) {
-                            this.emit('error', new Error(`HTML too long for parsing ${node.textContent.length} bytes`));
-                            text.push('Invalid HTML content (too long)');
-                            failedToParseHtml = true;
                         } else {
-                            try {
-                                text.push(htmlToText(node.textContent));
-                            } catch (err) {
-                                this.emit('error', new Error('Failed to parse HTML'));
-                                text.push('Invalid HTML content');
-                                failedToParseHtml = true;
+                            // HTML that can not be converted is no reason to lose the message:
+                            // the text stays empty, the HTML is kept and the reason travels with
+                            // the result as textConversionError. An 'error' event here used to
+                            // reject the whole simpleParser() promise, headers and attachments
+                            // included, after burning the CPU the conversion attempt took
+                            let err = null;
+                            if (node.textContent.length > this.options.maxHtmlLengthToParse) {
+                                err = new Error(`HTML too long for parsing ${node.textContent.length} bytes`);
+                            } else if (exceedsHtmlNestingDepth(node.textContent, MAX_HTML_NESTING_DEPTH)) {
+                                err = new Error(`HTML nested deeper than ${MAX_HTML_NESTING_DEPTH} levels`);
+                            } else {
+                                try {
+                                    text.push(htmlToText(node.textContent, { limits: { maxDepth: MAX_HTML_NESTING_DEPTH } }));
+                                } catch (cause) {
+                                    err = new Error('Failed to parse HTML', { cause });
+                                }
+                            }
+                            if (err) {
+                                text.push('');
+                                textConversionError = textConversionError || err;
                             }
                         }
                     }
-                    if (!failedToParseHtml) {
-                        html.push(node.textContent);
-                    }
+                    html.push(node.textContent);
                 }
             }
             alternative = alternative || node.contentType === 'multipart/alternative';
@@ -888,6 +979,9 @@ class MailParser extends Transform {
             this.text = response.text = text.join('\n');
             this.textAsHtml = response.textAsHtml = text.map(part => this.textToHtml(part)).join('<br/>\n');
         }
+        if (textConversionError) {
+            response.textConversionError = textConversionError;
+        }
         return response;
     }
 
@@ -1147,7 +1241,8 @@ class MailParser extends Transform {
                 .map(address => {
                     let str = '';
                     if (address.name) {
-                        str += `"${address.name}"` + (address.group ? ': ' : '');
+                        // a quoted-string, so a quote or backslash inside the name is escaped
+                        str += `"${address.name.replace(/["\\]/g, '\\$&')}"` + (address.group ? ': ' : '');
                     }
                     if (address.address) {
                         let link = address.address;

package/lib/simple-parser.js

@@ -19,8 +19,8 @@ module.exports = (input, options, callback) => {
         });
     }
 
-    // MailParser may emit a non-fatal 'error' (eg. HTML too long to convert to text) and
-    // still reach 'end', so settle only once: the first error or the result wins
+    // MailParser may emit a non-fatal 'error' and still reach 'end', so settle only once:
+    // the first error or the result wins
     let settled = false;
     let settle = callback;
     callback = (...args) => {
@@ -62,7 +62,7 @@ module.exports = (input, options, callback) => {
 
         if (data.type === 'text') {
             Object.keys(data).forEach(key => {
-                if (['text', 'html', 'textAsHtml'].includes(key)) {
+                if (['text', 'html', 'textAsHtml', 'textConversionError'].includes(key)) {
                     mail[key] = data[key];
                 }
             });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.38",
+    "version": "3.9.40",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -18,14 +18,14 @@
     ],
     "license": "MIT",
     "dependencies": {
+        "@zone-eu/mailsplit": "5.4.23",
         "encoding-japanese": "2.4.0",
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
-        "libmime": "5.4.7",
+        "libmime": "5.4.9",
         "linkify-it": "5.0.2",
-        "@zone-eu/mailsplit": "5.4.20",
-        "nodemailer": "10.1.0",
+        "nodemailer": "10.1.2",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
@@ -41,7 +41,7 @@
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "27.0.0",
         "iconv": "3.0.1",
-        "prettier": "3.9.9",
+        "prettier": "3.9.10",
         "random-message": "1.1.0"
     },
     "repository": {