nodemailer 10.1.5 → 10.1.6

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## [10.1.6](https://github.com/nodemailer/nodemailer/compare/v10.1.5...v10.1.6) (2026-10-18)
+
+
+### Bug Fixes
+
+* **addressparser:** read groups in the same pass as the rest of the list ([ddf0de1](https://github.com/nodemailer/nodemailer/commit/ddf0de1e7615908101bf593c62edcadccc05c8d3))
+
 ## [10.1.5](https://github.com/nodemailer/nodemailer/compare/v10.1.4...v10.1.5) (2026-10-18)
 
 

package/dist/cjs/addressparser/index.js

@@ -532,22 +532,19 @@ function _stripAddressComments(address) {
     return { address: result.trim(), comments: comments.filter(text => text) };
 }
 /**
- * Converts tokens for a single address into an address object
+ * Walks the tokens of one entry of an address list and sorts them into the runs of display
+ * text, angle-addr and comment they belong to
  *
  * @param tokens Tokens of the whole address list
- * @param from Index of the first token of this address
- * @param to Index just past the last token of this address
- * @param depth Current recursion depth for nested group protection
- * @return Address object
+ * @param from Index of the first token of the entry
+ * @param to Index just past the last token of the entry
+ * @return The collected runs, and whether the display text came out of a comment
  */
-function _handleAddress(tokens, from, to, depth) {
-    let isGroup = false;
+function _collectAddressParts(tokens, from, to) {
     let state = 'text';
-    const addresses = [];
     const data = {
         address: [],
         comment: [],
-        group: [],
         text: [],
         textWasQuoted: [],
         quotedLocalAt: []
@@ -561,7 +558,7 @@ function _handleAddress(tokens, from, to, depth) {
     // every token, which is quadratic over an address built from many comment-joined atoms
     // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
     // character is carried along instead of re-read.
-    const lastChars = { address: '', comment: '', group: '', text: '' };
+    const lastChars = { address: '', comment: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = from; i < to; i++) {
         const value = tokens.value(i);
@@ -578,11 +575,6 @@ function _handleAddress(tokens, from, to, depth) {
                     state = 'comment';
                     insideQuotes = false;
                     break;
-                case ':':
-                    state = 'group';
-                    isGroup = true;
-                    insideQuotes = false;
-                    break;
                 case '"':
                     insideQuotes = !insideQuotes;
                     state = 'text';
@@ -643,153 +635,156 @@ function _handleAddress(tokens, from, to, depth) {
         data.comment = [];
         textFromComment = true;
     }
-    if (isGroup) {
-        // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
-        data.text = data.text.join(' ');
-        // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
-        let groupMembers = [];
-        if (data.group.length) {
-            const parsedGroup = _parseAddressList(data.group.join(','), depth + 1);
-            parsedGroup.forEach(member => {
-                if (member.group) {
-                    groupMembers = groupMembers.concat(member.group);
-                }
-                else {
-                    groupMembers.push(member);
-                }
-            });
+    return { data, textFromComment };
+}
+/**
+ * Name of a group, from the tokens in front of its ':'. A comment names it when no text does,
+ * as it names a mailbox.
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token in front of the ':'
+ * @param to Index of the ':'
+ * @return Name of the group
+ */
+function _groupName(tokens, from, to) {
+    // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
+    return _collectAddressParts(tokens, from, to).data.text.join(' ');
+}
+/**
+ * Converts tokens for a single address into an address object
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of this address
+ * @param to Index just past the last token of this address
+ * @return Address object
+ */
+function _handleAddress(tokens, from, to) {
+    const collected = _collectAddressParts(tokens, from, to);
+    const data = collected.data;
+    let textFromComment = collected.textFromComment;
+    // Comments come out of the angle-addr before anything asks whether one was found, so
+    // that brackets holding nothing but a comment read the same as empty ones
+    const addressComments = [];
+    const addressParts = [];
+    for (const part of data.address) {
+        const stripped = _stripAddressComments(part);
+        for (const comment of stripped.comments) {
+            addressComments.push(comment);
+        }
+        if (stripped.address) {
+            addressParts.push(stripped.address);
         }
-        addresses.push({
-            name: data.text || '',
-            group: groupMembers
-        });
     }
-    else {
-        // Comments come out of the angle-addr before anything asks whether one was found, so
-        // that brackets holding nothing but a comment read the same as empty ones
-        const addressComments = [];
-        const addressParts = [];
-        for (const part of data.address) {
-            const stripped = _stripAddressComments(part);
-            for (const comment of stripped.comments) {
-                addressComments.push(comment);
-            }
-            if (stripped.address) {
-                addressParts.push(stripped.address);
+    data.address = addressParts;
+    // If no address was found, try to detect one from regular text
+    if (!data.address.length && data.text.length && !textFromComment) {
+        // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
+        // tiers read the collapsed runs, and only a run an address comes out of is replaced
+        // by its collapsed form, the display text keeps its spacing
+        const candidates = data.text.map((part) => _collapseAtSpacing(part));
+        // The first addr-spec in the text is the mailbox, as it is for a conformant parser
+        // reading as far as it can. Taking the last one let a comment part two of them and
+        // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
+        // same two without the comment, one run, went to good.com
+        for (let i = 0; i < data.text.length; i++) {
+            // Security: Do not extract email addresses from quoted strings.
+            // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
+            // Extracting emails from quoted text leads to misrouting vulnerabilities.
+            // A run that is a quoted local part with its '@' and domain is an addr-spec of
+            // its own, with the quoting put back on, and takes its turn like any other
+            const local = data.quotedLocalAt[i];
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
+                ? _quoteLocalPart(data.text[i])
+                : '';
+            if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
+                data.address = [quotedLocal || candidates[i]];
+                data.text.splice(i, 1);
+                data.textWasQuoted.splice(i, 1);
+                data.quotedLocalAt.splice(i, 1);
+                break;
             }
         }
-        data.address = addressParts;
-        // If no address was found, try to detect one from regular text
-        if (!data.address.length && data.text.length && !textFromComment) {
-            // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
-            // tiers read the collapsed runs, and only a run an address comes out of is replaced
-            // by its collapsed form, the display text keeps its spacing
-            const candidates = data.text.map((part) => _collapseAtSpacing(part));
-            // The first addr-spec in the text is the mailbox, as it is for a conformant parser
-            // reading as far as it can. Taking the last one let a comment part two of them and
-            // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
-            // same two without the comment, one run, went to good.com
+        // Try a looser regex match if strict match found nothing
+        if (!data.address.length) {
+            let extracted = false;
             for (let i = 0; i < data.text.length; i++) {
-                // Security: Do not extract email addresses from quoted strings.
-                // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
-                // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                // A run that is a quoted local part with its '@' and domain is an addr-spec of
-                // its own, with the quoting put back on, and takes its turn like any other
-                const local = data.quotedLocalAt[i];
-                const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
-                    ? _quoteLocalPart(data.text[i])
-                    : '';
-                if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
-                    data.address = [quotedLocal || candidates[i]];
-                    data.text.splice(i, 1);
-                    data.textWasQuoted.splice(i, 1);
-                    data.quotedLocalAt.splice(i, 1);
-                    break;
-                }
-            }
-            // Try a looser regex match if strict match found nothing
-            if (!data.address.length) {
-                let extracted = false;
-                for (let i = 0; i < data.text.length; i++) {
-                    // Security: Do not extract email addresses from quoted strings
-                    if (!data.textWasQuoted[i]) {
-                        // the strict tier found nothing, so it spliced nothing and the indexes still line up
-                        const part = candidates[i];
-                        let remainder = data.text[i];
-                        const at = _looseAddressStart(part);
-                        if (at >= 0) {
-                            LOOSE_TEXT_ADDR.lastIndex = at;
-                            const match = LOOSE_TEXT_ADDR.exec(part);
-                            if (match) {
-                                data.address = [match[0].trim()];
-                                extracted = true;
-                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
-                            }
-                        }
-                        data.text[i] = remainder.trim();
-                        if (extracted) {
-                            break;
+                // Security: Do not extract email addresses from quoted strings
+                if (!data.textWasQuoted[i]) {
+                    // the strict tier found nothing, so it spliced nothing and the indexes still line up
+                    const part = candidates[i];
+                    let remainder = data.text[i];
+                    const at = _looseAddressStart(part);
+                    if (at >= 0) {
+                        LOOSE_TEXT_ADDR.lastIndex = at;
+                        const match = LOOSE_TEXT_ADDR.exec(part);
+                        if (match) {
+                            data.address = [match[0].trim()];
+                            extracted = true;
+                            remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                         }
                     }
+                    data.text[i] = remainder.trim();
+                    if (extracted) {
+                        break;
+                    }
                 }
             }
         }
-        // If there's still no text but a comment exists, replace the two
-        if (!data.text.length && data.comment.length) {
-            data.text = data.comment;
-            data.comment = [];
-        }
-        // Keep only the first address occurrence, push others to regular text
-        if (data.address.length > 1) {
-            data.text = data.text.concat(data.address.splice(1));
-        }
-        // An address is only taken from unquoted text, so anything left in the text at this
-        // point that still has to serve as the address carries its quoting in this flag
-        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
-        // Join values with spaces
-        data.text = data.text.join(' ');
-        data.address = data.address.join(' ');
-        if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
-            // A quoted run with no '@' in it is a display name and nothing else, so it stays
-            // where it is. Moving it over anyway made a comment the mailbox was read from:
-            // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
-            // comment as the name, and a quoted name holding a ',' or a ';' became an address
-            // that reads as two recipients once a consumer writes it back into a header.
-            //
-            // The mailbox is still sitting in the text, so it moves over here and is quoted
-            // before the recovery below rather than after it. Anything else the text holds
-            // came along with it: a comment ends the domain but leaves the atoms behind it in
-            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
-            // 'user@example.com evil.com', a second domain riding into the envelope recipient
-            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
-            // back first is what lets the recovery tell the whitespace an addr-spec may carry
-            // from the wreckage trailing one, as only a quoted local part may hold whitespace
-            // The quotes are gone at this point, so the '@' the domain splits off at is the
-            // last one, not the single one _collapseAtSpacing insists on
-            data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
-            data.text = '';
-        }
-        _recoverAddrSpec(data);
-        // a comment names the mailbox only when nothing else does, as one outside the brackets
-        if (!data.text && addressComments.length) {
-            data.text = addressComments.join(' ');
-            textFromComment = true;
+    }
+    // If there's still no text but a comment exists, replace the two
+    if (!data.text.length && data.comment.length) {
+        data.text = data.comment;
+        data.comment = [];
+    }
+    // Keep only the first address occurrence, push others to regular text
+    if (data.address.length > 1) {
+        data.text = data.text.concat(data.address.splice(1));
+    }
+    // An address is only taken from unquoted text, so anything left in the text at this
+    // point that still has to serve as the address carries its quoting in this flag
+    const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+    // Join values with spaces
+    data.text = data.text.join(' ');
+    data.address = data.address.join(' ');
+    if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
+        // A quoted run with no '@' in it is a display name and nothing else, so it stays
+        // where it is. Moving it over anyway made a comment the mailbox was read from:
+        // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
+        // comment as the name, and a quoted name holding a ',' or a ';' became an address
+        // that reads as two recipients once a consumer writes it back into a header.
+        //
+        // The mailbox is still sitting in the text, so it moves over here and is quoted
+        // before the recovery below rather than after it. Anything else the text holds
+        // came along with it: a comment ends the domain but leaves the atoms behind it in
+        // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+        // 'user@example.com evil.com', a second domain riding into the envelope recipient
+        // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+        // back first is what lets the recovery tell the whitespace an addr-spec may carry
+        // from the wreckage trailing one, as only a quoted local part may hold whitespace
+        // The quotes are gone at this point, so the '@' the domain splits off at is the
+        // last one, not the single one _collapseAtSpacing insists on
+        data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
+        data.text = '';
+    }
+    _recoverAddrSpec(data);
+    // a comment names the mailbox only when nothing else does, as one outside the brackets
+    if (!data.text && addressComments.length) {
+        data.text = addressComments.join(' ');
+        textFromComment = true;
+    }
+    const address = {
+        address: data.address || (textFromComment ? '' : data.text) || '',
+        name: data.text || data.address || ''
+    };
+    if (address.address === address.name) {
+        if (/@/.test(address.address || '')) {
+            address.name = '';
         }
-        const address = {
-            address: data.address || (textFromComment ? '' : data.text) || '',
-            name: data.text || data.address || ''
-        };
-        if (address.address === address.name) {
-            if (/@/.test(address.address || '')) {
-                address.name = '';
-            }
-            else {
-                address.address = '';
-            }
+        else {
+            address.address = '';
         }
-        addresses.push(address);
     }
-    return addresses;
+    return address;
 }
 /* eslint-disable no-bitwise -- see TokenList */
 /**
@@ -807,6 +802,7 @@ class Tokenizer {
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
+        this.inGroup = false;
         this.innerQuoted = false;
         this.innerComment = 0;
         this.innerLiteral = false;
@@ -820,7 +816,9 @@ class Tokenizer {
             '(': ')',
             '<': '>',
             ',': '',
-            ':': ';',
+            // A group is read in the same pass as the rest of the list, so its ':' only marks
+            // where the name ends and its members are tokenized like any other address
+            ':': '',
             // Semicolons are not a legal delimiter per the RFC2822 grammar other
             // than for terminating a group, but they are also not valid for any
             // other use in this context.  Given that some mail clients have
@@ -946,15 +944,23 @@ class Tokenizer {
                 this.inDomainLiteral = false;
             }
         }
-        // The closer of an angle-addr or a group is only read outside the quoted strings,
-        // comments and domain literals it holds. Looking for nothing but the closer let a '>'
-        // inside a quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read
-        // as an address at evil.com, and a ';' inside a quoted display name or a comment end
-        // the group and release the rest of that text as recipients. The characters are still
-        // collected as they are, the angle-addr and the group content are read again later
+        // The closer of an angle-addr is only read outside the quoted strings, comments and
+        // domain literals it holds. Looking for nothing but the closer let a '>' inside a
+        // quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read as an
+        // address at evil.com. The characters are still collected as they are, the angle-addr
+        // is read again later
         let nested = false;
-        if (this.operatorExpecting === '>' || this.operatorExpecting === ';') {
+        if (this.operatorExpecting === '>') {
             nested = this._trackInner(chr);
+            if (!nested && chr === ';' && this.inGroup) {
+                // The ';' of a group ends an angle-addr left open inside it, as it always did
+                // when a group was cut out of the field at its ';' and parsed on its own. Read
+                // as text instead, an unclosed '<' swallowed the end of the group and every
+                // recipient after it
+                this._closeText(i);
+                this.operatorExpecting = '';
+                this._resetInner();
+            }
         }
         else if (this.operatorExpecting === ')' && !this.escaped) {
             // Comments nest (RFC 5322 3.2.2). Ending one at the first ')' let the ')' of a
@@ -987,6 +993,12 @@ class Tokenizer {
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
             this._closeText(i);
             this.list.push(TOKEN_OPERATOR, i, i + 1);
+            if (chr === ':') {
+                this.inGroup = true;
+            }
+            else if (chr === ';') {
+                this.inGroup = false;
+            }
             if (chr !== '(') {
                 this.afterAt = false;
             }
@@ -1032,13 +1044,11 @@ class Tokenizer {
         this.escaped = false;
     }
     /**
-     * Tracks the quoted strings, comments and domain literals inside an angle-addr or a
-     * group, which the closer of either must not be read from. A backslash escapes the next
-     * character inside a quoted string and a comment. A domain literal is only tracked in an
-     * angle-addr, where it opens right after an "@" and ends at the "]". dtext holds the list
-     * separators as well, and inside the brackets they never split the list anyway. In a group
-     * they do, so a literal is not tracked there and an unclosed "[" can not swallow the
-     * recipients after it.
+     * Tracks the quoted strings, comments and domain literals inside an angle-addr, which its
+     * closer must not be read from. A backslash escapes the next character inside a quoted
+     * string and a comment. A domain literal opens right after an "@" and ends at the "]".
+     * dtext holds the list separators as well, and inside the brackets they never split the
+     * list anyway.
      *
      * @param chr Character from the address field
      * @return true while the character sits inside one of them, the one that closes it included
@@ -1083,7 +1093,7 @@ class Tokenizer {
             this.innerComment = 1;
             return true;
         }
-        if (chr === '[' && this.afterAt && this.operatorExpecting === '>') {
+        if (chr === '[' && this.afterAt) {
             this.innerLiteral = true;
             return true;
         }
@@ -1106,32 +1116,51 @@ class Tokenizer {
 }
 /* eslint-enable no-bitwise */
 /**
- * Maximum recursion depth for parsing nested groups.
- * RFC 5322 doesn't allow nested groups, so this is a safeguard against
- * malicious input that could cause stack overflow. Every level parses what is left of the
- * value once more, so the limit is also the factor a crafted header multiplies the parse by.
+ * Folds the fragments an unquoted display name holding a comma is split into back together.
+ *
+ * "Joe Foo, PhD <joe@example.com>" is split on the comma into
+ * [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}]. A name-only entry
+ * followed by an entry with both name and address is recombined. Walked back to front so
+ * that a run of fragments folds into one entry in a single pass. Splicing each fragment out
+ * of the list instead would cost O(n^2).
+ *
+ * @param list Parsed entries, in order
+ * @return The entries with the fragments folded in
  */
-const MAX_NESTED_GROUP_DEPTH = 10;
+function _mergeNameFragments(list) {
+    const merged = [];
+    for (let i = list.length - 1; i >= 0; i--) {
+        const current = list[i];
+        const next = merged.length ? merged[merged.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
+            next.name = current.name + ', ' + next.name;
+        }
+        else {
+            merged.push(current);
+        }
+    }
+    return merged.reverse();
+}
 /**
- * Parses an address list, recursing into the groups it holds.
+ * Parses an address list, groups included, in a single pass over its tokens.
  *
- * The depth is threaded through the calls rather than carried in an options object, so a
- * caller supplied one can not seed it and lift the recursion limit: `{ _depth: -1e9 }`
- * bought a billion levels of nesting and turned the guard below into the stack overflow it
- * is there to prevent.
+ * A group used to be cut out of the field at the ';' that ends it and parsed again as an
+ * address list of its own, recursively, so every level of nesting parsed what was left of
+ * the field once more and the depth had to be capped. RFC 5322 does not nest groups at all,
+ * and the nested ones were flattened anyway. The tokens are now walked once: a ':' opens a
+ * group, its members are read as they come, a ';' closes it. A ':' inside an open group
+ * stands for a group nested in it, whose name is dropped and whose members belong to the
+ * outer one, which is how they were flattened before. The first ';' ends the group, nested
+ * or not, as it did.
  *
  * @param str Address field
- * @param depth Current recursion depth for nested group protection
  * @return An array of address objects
  */
-function _parseAddressList(str, depth) {
-    // Prevent stack overflow from deeply nested groups (DoS protection)
-    if (depth > MAX_NESTED_GROUP_DEPTH) {
-        return [];
-    }
-    const tokenizer = new Tokenizer(str);
-    const tokens = tokenizer.tokenize();
+function _parseAddressList(str) {
+    const tokens = new Tokenizer(str).tokenize();
     const parsedAddresses = [];
+    let group = null;
+    let members = [];
     // Every address is handed over as the range of the token list it covers, as soon as the
     // separator after it is seen. Copying the tokens of each address into an array of its own,
     // and collecting those before handling any, held a second structure as large as the token
@@ -1140,41 +1169,39 @@ function _parseAddressList(str, depth) {
     let from = 0;
     for (let i = 0, len = tokens.length; i <= len; i++) {
         const operator = i < len ? tokens.operatorAt(i) : '';
-        if (i < len && operator !== ',' && operator !== ';') {
+        if (i < len && operator !== ',' && operator !== ';' && operator !== ':') {
+            continue;
+        }
+        if (operator === ':') {
+            if (!group) {
+                group = { name: _groupName(tokens, from, i), group: [] };
+                members = [];
+            }
+            from = i + 1;
             continue;
         }
         if (i > from) {
-            const handled = _handleAddress(tokens, from, i, depth);
             // Appended in place. Rebuilding the accumulator with concat() would copy every
             // entry collected so far on each address, making a flat list cost O(n^2).
-            for (let j = 0; j < handled.length; j++) {
-                parsedAddresses.push(handled[j]);
+            const address = _handleAddress(tokens, from, i);
+            if (group) {
+                members.push(address);
+            }
+            else {
+                parsedAddresses.push(address);
             }
         }
         from = i + 1;
-    }
-    // Merge fragments produced when unquoted display names contain commas.
-    // "Joe Foo, PhD <joe@example.com>" is split on the comma into
-    // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
-    // Recombine: a name-only entry followed by an entry with both name and address.
-    // Walked back to front so that a run of fragments folds into one entry in a single
-    // pass. Splicing each fragment out of the list instead would cost O(n^2).
-    const mergedAddresses = [];
-    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
-        const current = parsedAddresses[i];
-        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
-        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
-            next.name = current.name + ', ' + next.name;
-        }
-        else {
-            mergedAddresses.push(current);
+        if (group && (operator === ';' || i === len)) {
+            group.group = _mergeNameFragments(members);
+            parsedAddresses.push(group);
+            group = null;
         }
     }
-    mergedAddresses.reverse();
-    return mergedAddresses;
+    return _mergeNameFragments(parsedAddresses);
 }
 function addressparser(str, options) {
-    const parsedAddresses = _parseAddressList(str, 0);
+    const parsedAddresses = _parseAddressList(str);
     if (options?.flatten) {
         const flatAddresses = [];
         const walkAddressList = (list) => {

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.5";
+export declare const version = "10.1.6";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.5';
+exports.version = '10.1.6';
 exports.homepage = 'https://nodemailer.com/';

package/dist/esm/addressparser/index.js

@@ -530,22 +530,19 @@ function _stripAddressComments(address) {
     return { address: result.trim(), comments: comments.filter(text => text) };
 }
 /**
- * Converts tokens for a single address into an address object
+ * Walks the tokens of one entry of an address list and sorts them into the runs of display
+ * text, angle-addr and comment they belong to
  *
  * @param tokens Tokens of the whole address list
- * @param from Index of the first token of this address
- * @param to Index just past the last token of this address
- * @param depth Current recursion depth for nested group protection
- * @return Address object
+ * @param from Index of the first token of the entry
+ * @param to Index just past the last token of the entry
+ * @return The collected runs, and whether the display text came out of a comment
  */
-function _handleAddress(tokens, from, to, depth) {
-    let isGroup = false;
+function _collectAddressParts(tokens, from, to) {
     let state = 'text';
-    const addresses = [];
     const data = {
         address: [],
         comment: [],
-        group: [],
         text: [],
         textWasQuoted: [],
         quotedLocalAt: []
@@ -559,7 +556,7 @@ function _handleAddress(tokens, from, to, depth) {
     // every token, which is quadratic over an address built from many comment-joined atoms
     // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
     // character is carried along instead of re-read.
-    const lastChars = { address: '', comment: '', group: '', text: '' };
+    const lastChars = { address: '', comment: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = from; i < to; i++) {
         const value = tokens.value(i);
@@ -576,11 +573,6 @@ function _handleAddress(tokens, from, to, depth) {
                     state = 'comment';
                     insideQuotes = false;
                     break;
-                case ':':
-                    state = 'group';
-                    isGroup = true;
-                    insideQuotes = false;
-                    break;
                 case '"':
                     insideQuotes = !insideQuotes;
                     state = 'text';
@@ -641,153 +633,156 @@ function _handleAddress(tokens, from, to, depth) {
         data.comment = [];
         textFromComment = true;
     }
-    if (isGroup) {
-        // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
-        data.text = data.text.join(' ');
-        // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
-        let groupMembers = [];
-        if (data.group.length) {
-            const parsedGroup = _parseAddressList(data.group.join(','), depth + 1);
-            parsedGroup.forEach(member => {
-                if (member.group) {
-                    groupMembers = groupMembers.concat(member.group);
-                }
-                else {
-                    groupMembers.push(member);
-                }
-            });
+    return { data, textFromComment };
+}
+/**
+ * Name of a group, from the tokens in front of its ':'. A comment names it when no text does,
+ * as it names a mailbox.
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token in front of the ':'
+ * @param to Index of the ':'
+ * @return Name of the group
+ */
+function _groupName(tokens, from, to) {
+    // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
+    return _collectAddressParts(tokens, from, to).data.text.join(' ');
+}
+/**
+ * Converts tokens for a single address into an address object
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of this address
+ * @param to Index just past the last token of this address
+ * @return Address object
+ */
+function _handleAddress(tokens, from, to) {
+    const collected = _collectAddressParts(tokens, from, to);
+    const data = collected.data;
+    let textFromComment = collected.textFromComment;
+    // Comments come out of the angle-addr before anything asks whether one was found, so
+    // that brackets holding nothing but a comment read the same as empty ones
+    const addressComments = [];
+    const addressParts = [];
+    for (const part of data.address) {
+        const stripped = _stripAddressComments(part);
+        for (const comment of stripped.comments) {
+            addressComments.push(comment);
+        }
+        if (stripped.address) {
+            addressParts.push(stripped.address);
         }
-        addresses.push({
-            name: data.text || '',
-            group: groupMembers
-        });
     }
-    else {
-        // Comments come out of the angle-addr before anything asks whether one was found, so
-        // that brackets holding nothing but a comment read the same as empty ones
-        const addressComments = [];
-        const addressParts = [];
-        for (const part of data.address) {
-            const stripped = _stripAddressComments(part);
-            for (const comment of stripped.comments) {
-                addressComments.push(comment);
-            }
-            if (stripped.address) {
-                addressParts.push(stripped.address);
+    data.address = addressParts;
+    // If no address was found, try to detect one from regular text
+    if (!data.address.length && data.text.length && !textFromComment) {
+        // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
+        // tiers read the collapsed runs, and only a run an address comes out of is replaced
+        // by its collapsed form, the display text keeps its spacing
+        const candidates = data.text.map((part) => _collapseAtSpacing(part));
+        // The first addr-spec in the text is the mailbox, as it is for a conformant parser
+        // reading as far as it can. Taking the last one let a comment part two of them and
+        // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
+        // same two without the comment, one run, went to good.com
+        for (let i = 0; i < data.text.length; i++) {
+            // Security: Do not extract email addresses from quoted strings.
+            // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
+            // Extracting emails from quoted text leads to misrouting vulnerabilities.
+            // A run that is a quoted local part with its '@' and domain is an addr-spec of
+            // its own, with the quoting put back on, and takes its turn like any other
+            const local = data.quotedLocalAt[i];
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
+                ? _quoteLocalPart(data.text[i])
+                : '';
+            if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
+                data.address = [quotedLocal || candidates[i]];
+                data.text.splice(i, 1);
+                data.textWasQuoted.splice(i, 1);
+                data.quotedLocalAt.splice(i, 1);
+                break;
             }
         }
-        data.address = addressParts;
-        // If no address was found, try to detect one from regular text
-        if (!data.address.length && data.text.length && !textFromComment) {
-            // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
-            // tiers read the collapsed runs, and only a run an address comes out of is replaced
-            // by its collapsed form, the display text keeps its spacing
-            const candidates = data.text.map((part) => _collapseAtSpacing(part));
-            // The first addr-spec in the text is the mailbox, as it is for a conformant parser
-            // reading as far as it can. Taking the last one let a comment part two of them and
-            // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
-            // same two without the comment, one run, went to good.com
+        // Try a looser regex match if strict match found nothing
+        if (!data.address.length) {
+            let extracted = false;
             for (let i = 0; i < data.text.length; i++) {
-                // Security: Do not extract email addresses from quoted strings.
-                // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
-                // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                // A run that is a quoted local part with its '@' and domain is an addr-spec of
-                // its own, with the quoting put back on, and takes its turn like any other
-                const local = data.quotedLocalAt[i];
-                const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
-                    ? _quoteLocalPart(data.text[i])
-                    : '';
-                if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
-                    data.address = [quotedLocal || candidates[i]];
-                    data.text.splice(i, 1);
-                    data.textWasQuoted.splice(i, 1);
-                    data.quotedLocalAt.splice(i, 1);
-                    break;
-                }
-            }
-            // Try a looser regex match if strict match found nothing
-            if (!data.address.length) {
-                let extracted = false;
-                for (let i = 0; i < data.text.length; i++) {
-                    // Security: Do not extract email addresses from quoted strings
-                    if (!data.textWasQuoted[i]) {
-                        // the strict tier found nothing, so it spliced nothing and the indexes still line up
-                        const part = candidates[i];
-                        let remainder = data.text[i];
-                        const at = _looseAddressStart(part);
-                        if (at >= 0) {
-                            LOOSE_TEXT_ADDR.lastIndex = at;
-                            const match = LOOSE_TEXT_ADDR.exec(part);
-                            if (match) {
-                                data.address = [match[0].trim()];
-                                extracted = true;
-                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
-                            }
-                        }
-                        data.text[i] = remainder.trim();
-                        if (extracted) {
-                            break;
+                // Security: Do not extract email addresses from quoted strings
+                if (!data.textWasQuoted[i]) {
+                    // the strict tier found nothing, so it spliced nothing and the indexes still line up
+                    const part = candidates[i];
+                    let remainder = data.text[i];
+                    const at = _looseAddressStart(part);
+                    if (at >= 0) {
+                        LOOSE_TEXT_ADDR.lastIndex = at;
+                        const match = LOOSE_TEXT_ADDR.exec(part);
+                        if (match) {
+                            data.address = [match[0].trim()];
+                            extracted = true;
+                            remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                         }
                     }
+                    data.text[i] = remainder.trim();
+                    if (extracted) {
+                        break;
+                    }
                 }
             }
         }
-        // If there's still no text but a comment exists, replace the two
-        if (!data.text.length && data.comment.length) {
-            data.text = data.comment;
-            data.comment = [];
-        }
-        // Keep only the first address occurrence, push others to regular text
-        if (data.address.length > 1) {
-            data.text = data.text.concat(data.address.splice(1));
-        }
-        // An address is only taken from unquoted text, so anything left in the text at this
-        // point that still has to serve as the address carries its quoting in this flag
-        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
-        // Join values with spaces
-        data.text = data.text.join(' ');
-        data.address = data.address.join(' ');
-        if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
-            // A quoted run with no '@' in it is a display name and nothing else, so it stays
-            // where it is. Moving it over anyway made a comment the mailbox was read from:
-            // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
-            // comment as the name, and a quoted name holding a ',' or a ';' became an address
-            // that reads as two recipients once a consumer writes it back into a header.
-            //
-            // The mailbox is still sitting in the text, so it moves over here and is quoted
-            // before the recovery below rather than after it. Anything else the text holds
-            // came along with it: a comment ends the domain but leaves the atoms behind it in
-            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
-            // 'user@example.com evil.com', a second domain riding into the envelope recipient
-            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
-            // back first is what lets the recovery tell the whitespace an addr-spec may carry
-            // from the wreckage trailing one, as only a quoted local part may hold whitespace
-            // The quotes are gone at this point, so the '@' the domain splits off at is the
-            // last one, not the single one _collapseAtSpacing insists on
-            data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
-            data.text = '';
-        }
-        _recoverAddrSpec(data);
-        // a comment names the mailbox only when nothing else does, as one outside the brackets
-        if (!data.text && addressComments.length) {
-            data.text = addressComments.join(' ');
-            textFromComment = true;
+    }
+    // If there's still no text but a comment exists, replace the two
+    if (!data.text.length && data.comment.length) {
+        data.text = data.comment;
+        data.comment = [];
+    }
+    // Keep only the first address occurrence, push others to regular text
+    if (data.address.length > 1) {
+        data.text = data.text.concat(data.address.splice(1));
+    }
+    // An address is only taken from unquoted text, so anything left in the text at this
+    // point that still has to serve as the address carries its quoting in this flag
+    const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+    // Join values with spaces
+    data.text = data.text.join(' ');
+    data.address = data.address.join(' ');
+    if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
+        // A quoted run with no '@' in it is a display name and nothing else, so it stays
+        // where it is. Moving it over anyway made a comment the mailbox was read from:
+        // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
+        // comment as the name, and a quoted name holding a ',' or a ';' became an address
+        // that reads as two recipients once a consumer writes it back into a header.
+        //
+        // The mailbox is still sitting in the text, so it moves over here and is quoted
+        // before the recovery below rather than after it. Anything else the text holds
+        // came along with it: a comment ends the domain but leaves the atoms behind it in
+        // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+        // 'user@example.com evil.com', a second domain riding into the envelope recipient
+        // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+        // back first is what lets the recovery tell the whitespace an addr-spec may carry
+        // from the wreckage trailing one, as only a quoted local part may hold whitespace
+        // The quotes are gone at this point, so the '@' the domain splits off at is the
+        // last one, not the single one _collapseAtSpacing insists on
+        data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
+        data.text = '';
+    }
+    _recoverAddrSpec(data);
+    // a comment names the mailbox only when nothing else does, as one outside the brackets
+    if (!data.text && addressComments.length) {
+        data.text = addressComments.join(' ');
+        textFromComment = true;
+    }
+    const address = {
+        address: data.address || (textFromComment ? '' : data.text) || '',
+        name: data.text || data.address || ''
+    };
+    if (address.address === address.name) {
+        if (/@/.test(address.address || '')) {
+            address.name = '';
         }
-        const address = {
-            address: data.address || (textFromComment ? '' : data.text) || '',
-            name: data.text || data.address || ''
-        };
-        if (address.address === address.name) {
-            if (/@/.test(address.address || '')) {
-                address.name = '';
-            }
-            else {
-                address.address = '';
-            }
+        else {
+            address.address = '';
         }
-        addresses.push(address);
     }
-    return addresses;
+    return address;
 }
 /* eslint-disable no-bitwise -- see TokenList */
 /**
@@ -805,6 +800,7 @@ class Tokenizer {
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
+        this.inGroup = false;
         this.innerQuoted = false;
         this.innerComment = 0;
         this.innerLiteral = false;
@@ -818,7 +814,9 @@ class Tokenizer {
             '(': ')',
             '<': '>',
             ',': '',
-            ':': ';',
+            // A group is read in the same pass as the rest of the list, so its ':' only marks
+            // where the name ends and its members are tokenized like any other address
+            ':': '',
             // Semicolons are not a legal delimiter per the RFC2822 grammar other
             // than for terminating a group, but they are also not valid for any
             // other use in this context.  Given that some mail clients have
@@ -944,15 +942,23 @@ class Tokenizer {
                 this.inDomainLiteral = false;
             }
         }
-        // The closer of an angle-addr or a group is only read outside the quoted strings,
-        // comments and domain literals it holds. Looking for nothing but the closer let a '>'
-        // inside a quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read
-        // as an address at evil.com, and a ';' inside a quoted display name or a comment end
-        // the group and release the rest of that text as recipients. The characters are still
-        // collected as they are, the angle-addr and the group content are read again later
+        // The closer of an angle-addr is only read outside the quoted strings, comments and
+        // domain literals it holds. Looking for nothing but the closer let a '>' inside a
+        // quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read as an
+        // address at evil.com. The characters are still collected as they are, the angle-addr
+        // is read again later
         let nested = false;
-        if (this.operatorExpecting === '>' || this.operatorExpecting === ';') {
+        if (this.operatorExpecting === '>') {
             nested = this._trackInner(chr);
+            if (!nested && chr === ';' && this.inGroup) {
+                // The ';' of a group ends an angle-addr left open inside it, as it always did
+                // when a group was cut out of the field at its ';' and parsed on its own. Read
+                // as text instead, an unclosed '<' swallowed the end of the group and every
+                // recipient after it
+                this._closeText(i);
+                this.operatorExpecting = '';
+                this._resetInner();
+            }
         }
         else if (this.operatorExpecting === ')' && !this.escaped) {
             // Comments nest (RFC 5322 3.2.2). Ending one at the first ')' let the ')' of a
@@ -985,6 +991,12 @@ class Tokenizer {
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
             this._closeText(i);
             this.list.push(TOKEN_OPERATOR, i, i + 1);
+            if (chr === ':') {
+                this.inGroup = true;
+            }
+            else if (chr === ';') {
+                this.inGroup = false;
+            }
             if (chr !== '(') {
                 this.afterAt = false;
             }
@@ -1030,13 +1042,11 @@ class Tokenizer {
         this.escaped = false;
     }
     /**
-     * Tracks the quoted strings, comments and domain literals inside an angle-addr or a
-     * group, which the closer of either must not be read from. A backslash escapes the next
-     * character inside a quoted string and a comment. A domain literal is only tracked in an
-     * angle-addr, where it opens right after an "@" and ends at the "]". dtext holds the list
-     * separators as well, and inside the brackets they never split the list anyway. In a group
-     * they do, so a literal is not tracked there and an unclosed "[" can not swallow the
-     * recipients after it.
+     * Tracks the quoted strings, comments and domain literals inside an angle-addr, which its
+     * closer must not be read from. A backslash escapes the next character inside a quoted
+     * string and a comment. A domain literal opens right after an "@" and ends at the "]".
+     * dtext holds the list separators as well, and inside the brackets they never split the
+     * list anyway.
      *
      * @param chr Character from the address field
      * @return true while the character sits inside one of them, the one that closes it included
@@ -1081,7 +1091,7 @@ class Tokenizer {
             this.innerComment = 1;
             return true;
         }
-        if (chr === '[' && this.afterAt && this.operatorExpecting === '>') {
+        if (chr === '[' && this.afterAt) {
             this.innerLiteral = true;
             return true;
         }
@@ -1104,32 +1114,51 @@ class Tokenizer {
 }
 /* eslint-enable no-bitwise */
 /**
- * Maximum recursion depth for parsing nested groups.
- * RFC 5322 doesn't allow nested groups, so this is a safeguard against
- * malicious input that could cause stack overflow. Every level parses what is left of the
- * value once more, so the limit is also the factor a crafted header multiplies the parse by.
+ * Folds the fragments an unquoted display name holding a comma is split into back together.
+ *
+ * "Joe Foo, PhD <joe@example.com>" is split on the comma into
+ * [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}]. A name-only entry
+ * followed by an entry with both name and address is recombined. Walked back to front so
+ * that a run of fragments folds into one entry in a single pass. Splicing each fragment out
+ * of the list instead would cost O(n^2).
+ *
+ * @param list Parsed entries, in order
+ * @return The entries with the fragments folded in
  */
-const MAX_NESTED_GROUP_DEPTH = 10;
+function _mergeNameFragments(list) {
+    const merged = [];
+    for (let i = list.length - 1; i >= 0; i--) {
+        const current = list[i];
+        const next = merged.length ? merged[merged.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
+            next.name = current.name + ', ' + next.name;
+        }
+        else {
+            merged.push(current);
+        }
+    }
+    return merged.reverse();
+}
 /**
- * Parses an address list, recursing into the groups it holds.
+ * Parses an address list, groups included, in a single pass over its tokens.
  *
- * The depth is threaded through the calls rather than carried in an options object, so a
- * caller supplied one can not seed it and lift the recursion limit: `{ _depth: -1e9 }`
- * bought a billion levels of nesting and turned the guard below into the stack overflow it
- * is there to prevent.
+ * A group used to be cut out of the field at the ';' that ends it and parsed again as an
+ * address list of its own, recursively, so every level of nesting parsed what was left of
+ * the field once more and the depth had to be capped. RFC 5322 does not nest groups at all,
+ * and the nested ones were flattened anyway. The tokens are now walked once: a ':' opens a
+ * group, its members are read as they come, a ';' closes it. A ':' inside an open group
+ * stands for a group nested in it, whose name is dropped and whose members belong to the
+ * outer one, which is how they were flattened before. The first ';' ends the group, nested
+ * or not, as it did.
  *
  * @param str Address field
- * @param depth Current recursion depth for nested group protection
  * @return An array of address objects
  */
-function _parseAddressList(str, depth) {
-    // Prevent stack overflow from deeply nested groups (DoS protection)
-    if (depth > MAX_NESTED_GROUP_DEPTH) {
-        return [];
-    }
-    const tokenizer = new Tokenizer(str);
-    const tokens = tokenizer.tokenize();
+function _parseAddressList(str) {
+    const tokens = new Tokenizer(str).tokenize();
     const parsedAddresses = [];
+    let group = null;
+    let members = [];
     // Every address is handed over as the range of the token list it covers, as soon as the
     // separator after it is seen. Copying the tokens of each address into an array of its own,
     // and collecting those before handling any, held a second structure as large as the token
@@ -1138,41 +1167,39 @@ function _parseAddressList(str, depth) {
     let from = 0;
     for (let i = 0, len = tokens.length; i <= len; i++) {
         const operator = i < len ? tokens.operatorAt(i) : '';
-        if (i < len && operator !== ',' && operator !== ';') {
+        if (i < len && operator !== ',' && operator !== ';' && operator !== ':') {
+            continue;
+        }
+        if (operator === ':') {
+            if (!group) {
+                group = { name: _groupName(tokens, from, i), group: [] };
+                members = [];
+            }
+            from = i + 1;
             continue;
         }
         if (i > from) {
-            const handled = _handleAddress(tokens, from, i, depth);
             // Appended in place. Rebuilding the accumulator with concat() would copy every
             // entry collected so far on each address, making a flat list cost O(n^2).
-            for (let j = 0; j < handled.length; j++) {
-                parsedAddresses.push(handled[j]);
+            const address = _handleAddress(tokens, from, i);
+            if (group) {
+                members.push(address);
+            }
+            else {
+                parsedAddresses.push(address);
             }
         }
         from = i + 1;
-    }
-    // Merge fragments produced when unquoted display names contain commas.
-    // "Joe Foo, PhD <joe@example.com>" is split on the comma into
-    // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
-    // Recombine: a name-only entry followed by an entry with both name and address.
-    // Walked back to front so that a run of fragments folds into one entry in a single
-    // pass. Splicing each fragment out of the list instead would cost O(n^2).
-    const mergedAddresses = [];
-    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
-        const current = parsedAddresses[i];
-        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
-        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
-            next.name = current.name + ', ' + next.name;
-        }
-        else {
-            mergedAddresses.push(current);
+        if (group && (operator === ';' || i === len)) {
+            group.group = _mergeNameFragments(members);
+            parsedAddresses.push(group);
+            group = null;
         }
     }
-    mergedAddresses.reverse();
-    return mergedAddresses;
+    return _mergeNameFragments(parsedAddresses);
 }
 function addressparser(str, options) {
-    const parsedAddresses = _parseAddressList(str, 0);
+    const parsedAddresses = _parseAddressList(str);
     if (options?.flatten) {
         const flatAddresses = [];
         const walkAddressList = (list) => {

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.5";
+export declare const version = "10.1.6";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.5';
+export const version = '10.1.6';
 export const homepage = 'https://nodemailer.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.5",
+    "version": "10.1.6",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",