nodemailer 10.1.2 → 10.1.4

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # CHANGELOG
 
+## [10.1.4](https://github.com/nodemailer/nodemailer/compare/v10.1.3...v10.1.4) (2026-10-18)
+
+
+### Bug Fixes
+
+* **addressparser:** apply the unexpected "<" rule outside quotes and comments ([ee35f57](https://github.com/nodemailer/nodemailer/commit/ee35f5745658bf46952651fa53207255e9dc3406))
+* **addressparser:** bound group nesting at ten levels ([ce63303](https://github.com/nodemailer/nodemailer/commit/ce633031d58f8d2e9c9b0f5b671944a1afe71f95))
+* **addressparser:** drop the obsolete route from an angle-addr ([3dbc730](https://github.com/nodemailer/nodemailer/commit/3dbc7304b0cfa06551543fa2dc01222447c2b554))
+* **addressparser:** end a comment only at the ")" that closes the outermost one ([0a87617](https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011))
+* **addressparser:** honour quoted strings and comments inside an angle-addr and a group ([1cd57d2](https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2))
+* **addressparser:** never read a mailbox out of a comment ([a1538ea](https://github.com/nodemailer/nodemailer/commit/a1538ea39c76c48a4134806c41e31e59a258b1e5))
+* **addressparser:** read CFWS beside the "@" of an addr-spec as nothing ([ba3c095](https://github.com/nodemailer/nodemailer/commit/ba3c0952542581f95cb20d9322cc9e27baa470a2))
+* **addressparser:** read the first addr-spec of the display text ([038940a](https://github.com/nodemailer/nodemailer/commit/038940a069a2cecb64a70d0e81b17eb8ce200d3a))
+* split a domain literal off at the "@" in front of it ([d5983b0](https://github.com/nodemailer/nodemailer/commit/d5983b0ae234cd22ab45be817fefd434e9a53d58))
+
+## [10.1.3](https://github.com/nodemailer/nodemailer/compare/v10.1.2...v10.1.3) (2026-10-18)
+
+
+### Bug Fixes
+
+* format References and strip URLs in linear time, release any number of streams ([2f18641](https://github.com/nodemailer/nodemailer/commit/2f186418cf6c8fff18f235d4318892fd42f810fa))
+
 ## [10.1.2](https://github.com/nodemailer/nodemailer/compare/v10.1.1...v10.1.2) (2026-10-16)
 
 

package/dist/cjs/addressparser/index.js

@@ -1,5 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
+ * in front of the literal is the one that splits the domain off, not the last one: reading
+ * 'a@[x@evil.com]' at its last '@' made it an address at evil.com.
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Offset of the '@' that splits the domain off an address, or -1 when there is none
+ *
+ * @param address Address to split
+ * @return Offset of the '@'
+ */
+function _domainAt(address) {
+    const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+    return literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
+}
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *
@@ -18,7 +34,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * @return Address with the local part as a quoted-string
  */
 function _quoteLocalPart(address) {
-    const lastAt = address.lastIndexOf('@');
+    const lastAt = _domainAt(address);
     if (lastAt < 0) {
         // no domain to split off, nothing can be misrouted
         return address;
@@ -44,6 +60,23 @@ const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
  * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
  */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+ * The same with a domain literal for the domain, which may hold an '@' of its own.
+ */
+const LITERAL_ADDR_SPEC = /^[^@\s]+@\[[^[\]\\\s]*\]$/;
+/**
+ * The '@' and domain that follow a quoted local part in the same run.
+ */
+const QUOTED_LOCAL_DOMAIN = /^@(?:[^@\s"]+|\[[^[\]\\\s]*\])$/;
+/**
+ * Whether a whitespace free run reads as an addr-spec under the strict grammar
+ *
+ * @param value Run to check
+ * @return true when it does
+ */
+function _isAddrSpec(value) {
+    return ADDR_SPEC.test(value) || LITERAL_ADDR_SPEC.test(value);
+}
 /**
  * The looser reading applied once the strict one finds nothing, which tolerates the
  * further '@' that a domain should not have but malformed headers carry anyway.
@@ -110,6 +143,62 @@ function _indexOfAt(text, from, to) {
     }
     return -1;
 }
+/**
+ * A quoted-string a value opens with.
+ */
+const LEADING_QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"/;
+/**
+ * Drops the whitespace on either side of the '@' at an offset.
+ *
+ * obs-local-part and obs-domain allow CFWS around the '@' (RFC 5322 4.4), so 'user @ good.com'
+ * names user@good.com. Kept, the whitespace went into the envelope as '"user "@ good.com'.
+ * The scan is by index, a pattern such as /\s+@/ backtracks over a long whitespace run that
+ * no '@' follows.
+ *
+ * @param value Value holding the '@'
+ * @param at Offset of the '@', or -1
+ * @return The value with the whitespace beside that '@' removed
+ */
+function _joinAtSpacing(value, at) {
+    if (at < 0) {
+        return value;
+    }
+    let start = at;
+    while (start > 0 && _isSpaceCode(value.charCodeAt(start - 1))) {
+        start--;
+    }
+    let end = at + 1;
+    while (end < value.length && _isSpaceCode(value.charCodeAt(end))) {
+        end++;
+    }
+    return start === at && end === at + 1 ? value : value.slice(0, start) + '@' + value.slice(end);
+}
+/**
+ * Drops the whitespace beside the '@' that splits the domain off a value. That is the '@'
+ * right after a quoted local part the value opens with, or else the only '@' it holds outside
+ * any quoted string. With several it is not clear which one the whitespace belongs to, and
+ * '<x@evil.com @good.com>' is left to the addr-spec recovery to read as it always has.
+ *
+ * @param value Value to clean up
+ * @return The value with the whitespace beside that '@' removed
+ */
+function _collapseAtSpacing(value) {
+    const quoted = LEADING_QUOTED_STRING.exec(value);
+    if (quoted) {
+        let at = quoted[0].length;
+        while (at < value.length && _isSpaceCode(value.charCodeAt(at))) {
+            at++;
+        }
+        if (value.charAt(at) === '@' && value.indexOf('@', at + 1) < 0) {
+            return _joinAtSpacing(value, at);
+        }
+    }
+    const at = value.indexOf('@');
+    if (at < 0 || value.indexOf('@', at + 1) >= 0 || value.lastIndexOf('"') > at) {
+        return value;
+    }
+    return _joinAtSpacing(value, at);
+}
 /**
  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
  *
@@ -199,6 +288,7 @@ function _looseAddressStart(text) {
  * @param data Collected address parts, mutated in place
  */
 function _recoverAddrSpec(data) {
+    data.address = _collapseAtSpacing(data.address);
     if (!HAS_WHITESPACE.test(data.address)) {
         return;
     }
@@ -225,7 +315,7 @@ function _recoverAddrSpec(data) {
             return;
         }
         const parts = data.address.split(/\s+/);
-        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        let addrIndex = parts.findIndex(_isAddrSpec);
         if (addrIndex < 0) {
             addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
         }
@@ -252,6 +342,15 @@ function _recoverAddrSpec(data) {
  * A comment is folding whitespace, so it is read as a space that splits two atoms and as
  * nothing next to an '@', the same rule the token walk applies outside the brackets. Quoted
  * strings and domain literals are copied through untouched, a '(' in there is not a comment.
+ * An unexpected '<' outside them drops everything in front of it, comments included.
+ *
+ * RFC 822 also let an angle-addr name the relays to go through in front of the mailbox,
+ * '<@relay1,@relay2:user@example.com>', which RFC 5322 still parses as obs-route. The route
+ * is not part of the mailbox, and folded into the local part it made
+ * '"@relay1,@relay2:user"@example.com' a recipient that does not exist. A local part can not
+ * start with '@', so contents that do, up to the first ':' outside a domain literal and in
+ * front of any quoted string, are a route and are dropped, as long as a mailbox with an '@'
+ * of its own follows.
  *
  * @param address Contents of the angle brackets
  * @return The address with the comments removed, and the text of the comments
@@ -265,6 +364,16 @@ function _stripAddressComments(address) {
     // carried along rather than read back off the growing result, which would flatten it on
     // every comment (see lastChars in _handleAddress)
     let lastChar = '';
+    // A comment that just closed stands for a space, written once the next character shows
+    // whether one is wanted: not beside an '@', and not on top of whitespace that follows.
+    // Deciding on the spot saw only the character right after the ')', so a second comment
+    // in a row hid the '@' behind it and 'a(x)(y)@b' read as 'a @b'
+    let pendingSpace = false;
+    // first character of the result and whether a quoted string has opened since, which
+    // together tell a route from a local part
+    let firstChar = '';
+    let quoteSeen = false;
+    let routeEnd = -1;
     for (let i = 0, len = address.length; i < len; i++) {
         const chr = address.charAt(i);
         if (depth) {
@@ -278,16 +387,20 @@ function _stripAddressComments(address) {
             else if (chr === ')' && !--depth) {
                 comments.push(comment.trim());
                 comment = '';
-                if (lastChar !== '@' && address.charAt(i + 1) !== '@') {
-                    result += ' ';
-                    lastChar = ' ';
-                }
+                pendingSpace = lastChar !== '@';
             }
             else {
                 comment += chr;
             }
             continue;
         }
+        if (pendingSpace && chr !== '(') {
+            pendingSpace = false;
+            if (chr !== '@' && chr !== '<' && !_isSpaceCode(address.charCodeAt(i))) {
+                result += ' ';
+                lastChar = ' ';
+            }
+        }
         if (closer) {
             if (chr === '\\' && closer === '"' && i < len - 1) {
                 result += chr + address.charAt(++i);
@@ -300,6 +413,10 @@ function _stripAddressComments(address) {
         }
         else if (chr === '"') {
             closer = '"';
+            quoteSeen = true;
+        }
+        else if (chr === ':' && routeEnd < 0 && firstChar === '@' && !quoteSeen) {
+            routeEnd = result.length + 1;
         }
         else if (chr === '[') {
             closer = ']';
@@ -308,8 +425,27 @@ function _stripAddressComments(address) {
             depth = 1;
             continue;
         }
+        else if (chr === '<') {
+            // Apple Mail drops everything between an unexpected '<' and the address after it.
+            // Read here rather than off the raw brackets so that a '<' inside a quoted string,
+            // a comment or a domain literal stays where it is: '<"a<b"@victim.com>' cut at
+            // the first '<' left the address 'b"@victim.com'
+            result = '';
+            lastChar = '';
+            comments.length = 0;
+            firstChar = '';
+            quoteSeen = false;
+            routeEnd = -1;
+            continue;
+        }
         result += chr;
         lastChar = chr;
+        if (!firstChar && !_isSpaceCode(address.charCodeAt(i))) {
+            firstChar = chr;
+        }
+    }
+    if (routeEnd >= 0 && result.indexOf('@', routeEnd) >= 0) {
+        result = result.slice(routeEnd);
     }
     if (depth) {
         // an unterminated comment runs to the end of the address
@@ -333,9 +469,13 @@ function _handleAddress(tokens, depth) {
         comment: [],
         group: [],
         text: [],
-        textWasQuoted: []
+        textWasQuoted: [],
+        quotedLocalAt: []
     };
     let insideQuotes = false;
+    // whether the last text run holds nothing but quoted text so far, which is what a quoted
+    // local part is until the '@' after it joins the run
+    let lastTextPureQuoted = false;
     // Last character of the run each state is currently accumulating. Reading it back off
     // the accumulator with slice(-1) makes the engine flatten the whole growing string on
     // every token, which is quadratic over an address built from many comment-joined atoms
@@ -385,11 +525,6 @@ function _handleAddress(tokens, depth) {
                 !!prevToken.noBreak &&
                 prevPrevToken?.type === 'operator' &&
                 prevPrevToken.value === '"';
-            if (state === 'address') {
-                // Handle unquoted name that includes a "<".
-                // Apple Mail truncates everything between an unexpected < and an address.
-                token.value = token.value.replace(/^[^<]*<\s*/, '');
-            }
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
@@ -400,12 +535,19 @@ function _handleAddress(tokens, depth) {
                 parts.length &&
                 (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
-                data[state][data[state].length - 1] += token.value;
+                const last = data[state].length - 1;
+                if (state === 'text' && !insideQuotes) {
+                    if (lastTextPureQuoted && token.value.charAt(0) === '@') {
+                        data.quotedLocalAt[last] = data.text[last].length;
+                    }
+                    lastTextPureQuoted = false;
+                }
+                data[state][last] += token.value;
                 if (token.value) {
                     lastChars[state] = token.value.charAt(token.value.length - 1);
                 }
                 if (state === 'text' && insideQuotes) {
-                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+                    data.textWasQuoted[last] = true;
                 }
             }
             else {
@@ -413,14 +555,21 @@ function _handleAddress(tokens, depth) {
                 lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+                    // an empty quoted string leaves no text of its own, so the '@' opens the run
+                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && token.value.charAt(0) === '@' ? 0 : -1);
+                    lastTextPureQuoted = insideQuotes;
                 }
             }
         }
     }
-    // If there is no text but a comment, replace the two
+    // If there is no text but a comment, replace the two. A comment is never part of a
+    // mailbox, so text that came out of one only ever names it: reading an address out of it
+    // made '(a@evil.com)' a recipient where no conformant reading has a mailbox at all
+    let textFromComment = false;
     if (!data.text.length && data.comment.length) {
         data.text = data.comment;
         data.comment = [];
+        textFromComment = true;
     }
     if (isGroup) {
         // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
@@ -449,10 +598,6 @@ function _handleAddress(tokens, depth) {
         const addressComments = [];
         const addressParts = [];
         for (const part of data.address) {
-            if (part.indexOf('(') < 0) {
-                addressParts.push(part);
-                continue;
-            }
             const stripped = _stripAddressComments(part);
             for (const comment of stripped.comments) {
                 addressComments.push(comment);
@@ -463,25 +608,42 @@ function _handleAddress(tokens, depth) {
         }
         data.address = addressParts;
         // If no address was found, try to detect one from regular text
-        if (!data.address.length && data.text.length) {
-            for (let i = data.text.length - 1; i >= 0; i--) {
+        if (!data.address.length && data.text.length && !textFromComment) {
+            // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
+            // tiers read the collapsed runs, and only a run an address comes out of is replaced
+            // by its collapsed form, the display text keeps its spacing
+            const candidates = data.text.map((part) => _collapseAtSpacing(part));
+            // The first addr-spec in the text is the mailbox, as it is for a conformant parser
+            // reading as far as it can. Taking the last one let a comment part two of them and
+            // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
+            // same two without the comment, one run, went to good.com
+            for (let i = 0; i < data.text.length; i++) {
                 // Security: Do not extract email addresses from quoted strings.
                 // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
                 // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
-                    data.address = data.text.splice(i, 1);
+                // A run that is a quoted local part with its '@' and domain is an addr-spec of
+                // its own, with the quoting put back on, and takes its turn like any other
+                const local = data.quotedLocalAt[i];
+                const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
+                    ? _quoteLocalPart(data.text[i])
+                    : '';
+                if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
+                    data.address = [quotedLocal || candidates[i]];
+                    data.text.splice(i, 1);
                     data.textWasQuoted.splice(i, 1);
+                    data.quotedLocalAt.splice(i, 1);
                     break;
                 }
             }
             // Try a looser regex match if strict match found nothing
             if (!data.address.length) {
                 let extracted = false;
-                for (let i = data.text.length - 1; i >= 0; i--) {
+                for (let i = 0; i < data.text.length; i++) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        const part = data.text[i];
-                        let remainder = part;
+                        // the strict tier found nothing, so it spliced nothing and the indexes still line up
+                        const part = candidates[i];
+                        let remainder = data.text[i];
                         const at = _looseAddressStart(part);
                         if (at >= 0) {
                             LOOSE_TEXT_ADDR.lastIndex = at;
@@ -530,16 +692,19 @@ function _handleAddress(tokens, depth) {
             // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
             // back first is what lets the recovery tell the whitespace an addr-spec may carry
             // from the wreckage trailing one, as only a quoted local part may hold whitespace
-            data.address = _quoteLocalPart(data.text);
+            // The quotes are gone at this point, so the '@' the domain splits off at is the
+            // last one, not the single one _collapseAtSpacing insists on
+            data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
             data.text = '';
         }
         _recoverAddrSpec(data);
         // a comment names the mailbox only when nothing else does, as one outside the brackets
         if (!data.text && addressComments.length) {
             data.text = addressComments.join(' ');
+            textFromComment = true;
         }
         const address = {
-            address: data.address || data.text || '',
+            address: data.address || (textFromComment ? '' : data.text) || '',
             name: data.text || data.address || ''
         };
         if (address.address === address.name) {
@@ -569,6 +734,10 @@ class Tokenizer {
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -635,10 +804,32 @@ class Tokenizer {
                 this.inDomainLiteral = false;
             }
         }
+        // The closer of an angle-addr or a group is only read outside the quoted strings,
+        // comments and domain literals it holds. Looking for nothing but the closer let a '>'
+        // inside a quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read
+        // as an address at evil.com, and a ';' inside a quoted display name or a comment end
+        // the group and release the rest of that text as recipients. The characters are still
+        // collected as they are, the angle-addr and the group content are read again later
+        let nested = false;
+        if (this.operatorExpecting === '>' || this.operatorExpecting === ';') {
+            nested = this._trackInner(chr);
+        }
+        else if (this.operatorExpecting === ')' && !this.escaped) {
+            // Comments nest (RFC 5322 3.2.2). Ending one at the first ')' let the ')' of a
+            // nested comment close the outer one and released the rest of it, an address
+            // included, into the header
+            if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')' && this.innerComment) {
+                this.innerComment--;
+                nested = true;
+            }
+        }
         if (this.escaped) {
             // ignore next condition blocks
         }
-        else if (chr === this.operatorExpecting) {
+        else if (chr === this.operatorExpecting && !nested) {
             this.node = {
                 type: 'operator',
                 value: chr
@@ -654,6 +845,7 @@ class Tokenizer {
             }
             this.operatorExpecting = '';
             this.escaped = false;
+            this._resetInner();
             return;
         }
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
@@ -668,6 +860,7 @@ class Tokenizer {
             }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
+            this._resetInner();
             return;
         }
         else if (['"', "'", ')'].includes(this.operatorExpecting) && chr === '\\') {
@@ -701,13 +894,86 @@ class Tokenizer {
         }
         this.escaped = false;
     }
+    /**
+     * Tracks the quoted strings, comments and domain literals inside an angle-addr or a
+     * group, which the closer of either must not be read from. A backslash escapes the next
+     * character inside a quoted string and a comment. A domain literal is only tracked in an
+     * angle-addr, where it opens right after an "@" and ends at the "]". dtext holds the list
+     * separators as well, and inside the brackets they never split the list anyway. In a group
+     * they do, so a literal is not tracked there and an unclosed "[" can not swallow the
+     * recipients after it.
+     *
+     * @param chr Character from the address field
+     * @return true while the character sits inside one of them, the one that closes it included
+     */
+    _trackInner(chr) {
+        if (this.innerEscaped) {
+            this.innerEscaped = false;
+            return true;
+        }
+        if (this.innerQuoted) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '"') {
+                this.innerQuoted = false;
+            }
+            return true;
+        }
+        if (this.innerComment) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')') {
+                this.innerComment--;
+            }
+            return true;
+        }
+        if (this.innerLiteral) {
+            if (chr === ']') {
+                this.innerLiteral = false;
+            }
+            return true;
+        }
+        if (chr === '"') {
+            this.innerQuoted = true;
+            return true;
+        }
+        if (chr === '(') {
+            this.innerComment = 1;
+            return true;
+        }
+        if (chr === '[' && this.afterAt && this.operatorExpecting === '>') {
+            this.innerLiteral = true;
+            return true;
+        }
+        // afterAt is otherwise only kept outside the operators and is cleared when one opens
+        // or ends, so inside an angle-addr it serves the literal tracked here
+        if (!_isSpaceCode(chr.charCodeAt(0))) {
+            this.afterAt = chr === '@';
+        }
+        return false;
+    }
+    /**
+     * Forgets the nesting collected for the operator that just opened or ended
+     */
+    _resetInner() {
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
+    }
 }
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
- * malicious input that could cause stack overflow.
+ * malicious input that could cause stack overflow. Every level parses what is left of the
+ * value once more, so the limit is also the factor a crafted header multiplies the parse by.
  */
-const MAX_NESTED_GROUP_DEPTH = 50;
+const MAX_NESTED_GROUP_DEPTH = 10;
 /**
  * Parses an address list, recursing into the groups it holds.
  *

package/dist/cjs/mailer/mail-message.js

@@ -183,7 +183,10 @@ class MailMessage {
         const values = [data.html, data.text, data.watchHtml, data.amp, data.raw, data.icalEvent];
         for (const key of ['attachments', 'alternatives']) {
             if (Array.isArray(data[key])) {
-                values.push(...data[key]);
+                // one at a time, spreading a long enough list into the arguments throws
+                for (const entry of data[key]) {
+                    values.push(entry);
+                }
             }
         }
         for (const value of values) {

package/dist/cjs/mime-node/index.js

@@ -64,6 +64,35 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // else goes into angle brackets so that the header can not be read as more addresses than
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+/**
+ * A domain literal that ends an address, see _normalizeAddress
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Removes the whitespace inside every <...> of a References value. A "<" with no ">" after
+ * it is left as it is. An index scan, the regex /<[^>]*>/g rescans the rest of the value
+ * from every such "<"
+ *
+ * @param value References header value
+ * @returns The value with the msg-ids closed up
+ */
+function stripWhitespaceInAngleBrackets(value) {
+    let result = '';
+    let pos = 0;
+    for (;;) {
+        const open = value.indexOf('<', pos);
+        if (open < 0) {
+            break;
+        }
+        const close = value.indexOf('>', open + 1);
+        if (close < 0) {
+            break;
+        }
+        result += value.slice(pos, open) + value.slice(open, close + 1).replace(/\s/g, '');
+        pos = close + 1;
+    }
+    return result + value.slice(pos);
+}
 // domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
 // mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
 // controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
@@ -1357,26 +1386,26 @@ class MimeNode {
                 }
                 return value;
             // space separated list of values enclosed in <>
-            case 'References':
-                value = [].concat
-                    .apply([], [].concat(value || '').map(elm => {
-                    elm = (elm || '')
+            case 'References': {
+                const ids = [];
+                for (const entry of [].concat(value || '')) {
+                    const elm = (entry || '')
                         .toString()
                         .replace(/\r?\n|\r/g, ' ')
                         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                         .trim();
-                    return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
-                }))
-                    .map(elm => {
-                    if (elm.charAt(0) !== '<') {
-                        elm = '<' + elm;
-                    }
-                    if (elm.charAt(elm.length - 1) !== '>') {
-                        elm = elm + '>';
+                    for (let id of stripWhitespaceInAngleBrackets(elm).split(/\s+/)) {
+                        if (id.charAt(0) !== '<') {
+                            id = '<' + id;
+                        }
+                        if (id.charAt(id.length - 1) !== '>') {
+                            id = id + '>';
+                        }
+                        ids.push(id);
                     }
-                    return elm;
-                });
-                return value.join(' ').trim();
+                }
+                return ids.join(' ').trim();
+            }
             case 'Date':
                 if (Object.prototype.toString.call(value) === '[object Date]') {
                     return value.toUTCString().replace(/GMT/, '+0000');
@@ -1455,7 +1484,10 @@ class MimeNode {
             // callers use an empty value to detect a missing address
             return address;
         }
-        const lastAt = address.lastIndexOf('@');
+        // dtext includes '@', so a domain literal is split off at the '@' in front of it and
+        // not at the last one, which delivered 'a@[x@evil.com]' to evil.com
+        const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+        const lastAt = literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
         if (lastAt < 0) {
             // Bare username, there is no domain to split off
             return this._normalizeLocalPart(address);

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.2";
+export declare const version = "10.1.4";
 export declare const homepage = "https://nodemailer.com/";