nodemailer 9.0.3 → 9.0.5

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## [9.0.5](https://github.com/nodemailer/nodemailer/compare/v9.0.4...v9.0.5) (2026-08-07)
+
+
+### Bug Fixes
+
+* **ci:** retrigger the workflows dropped during the Actions outage ([85d16c1](https://github.com/nodemailer/nodemailer/commit/85d16c103ec69e237c7e55c0e3103f439c135ce3))
+* **mailer:** escape specials in List-* header comments ([#1842](https://github.com/nodemailer/nodemailer/issues/1842)) ([75913bb](https://github.com/nodemailer/nodemailer/commit/75913bba032623046dd7fa037b8b880e388d8357))
+* **mime-funcs:** star the continuation key of a restarted parameter line ([36bcf1a](https://github.com/nodemailer/nodemailer/commit/36bcf1a21a92b5a283c780e35aacd3080292d98d))
+* **mime-node:** keep control chars out of header values and msg-id headers ([15cf6d1](https://github.com/nodemailer/nodemailer/commit/15cf6d1c15cdf60f551618fd54fb727ea7aac94c))
+* **mime:** encode DEL in header parameters and List-* comments ([cf69430](https://github.com/nodemailer/nodemailer/commit/cf69430ffac1d246bfbab564daf321f31ed9e1dd))
+* **mime:** keep control chars out of the remaining header positions ([5ed9d26](https://github.com/nodemailer/nodemailer/commit/5ed9d26f85eecb48f4b3ae74ad33ed2abf002040))
+* **mime:** normalize an address parsed out of a string as well ([63685f7](https://github.com/nodemailer/nodemailer/commit/63685f7dd4aefa75cc72a36f983f32f61cd6733e))
+* **mime:** normalize an address so header and envelope agree ([a9343b4](https://github.com/nodemailer/nodemailer/commit/a9343b47e42b9ccb27911ad8e73d4119c6170c85))
+* **mime:** stop a header key callback and the dkim tags from injecting ([b7d772e](https://github.com/nodemailer/nodemailer/commit/b7d772ea4ec12ee82e65a9b919af882bf0f125d9))
+
+## [9.0.4](https://github.com/nodemailer/nodemailer/compare/v9.0.3...v9.0.4) (2026-08-04)
+
+
+### Bug Fixes
+
+* **mime-funcs:** do not let an unpaired surrogate consume the next character ([9797f7f](https://github.com/nodemailer/nodemailer/commit/9797f7f57d47b1e27d8ae050550ba93600dbf9f4))
+* **mime-funcs:** keep any surrogate pair intact when chunking base64 mime words ([#1838](https://github.com/nodemailer/nodemailer/issues/1838)) ([5bd3a65](https://github.com/nodemailer/nodemailer/commit/5bd3a657be2d12df1ac2838a1673cb4885e99016))
+* **mime-funcs:** percent encode unpaired surrogates in header parameter values ([78f4aa2](https://github.com/nodemailer/nodemailer/commit/78f4aa253d0ebb9c5ba91301adacef5fb6cf5493))
+* **mime-node:** escape backslash and quote in the Content-Type name parameter ([#1837](https://github.com/nodemailer/nodemailer/issues/1837)) ([adcfc4f](https://github.com/nodemailer/nodemailer/commit/adcfc4f46445edc8a14136b2bf3f775943425c13))
+* **mime:** encode HT/CR/LF in header parameter values instead of quoting them ([#1840](https://github.com/nodemailer/nodemailer/issues/1840)) ([5bc9cab](https://github.com/nodemailer/nodemailer/commit/5bc9cabddcb8d18d16244701ae9facc8fba942a3))
+
 ## [9.0.3](https://github.com/nodemailer/nodemailer/compare/v9.0.2...v9.0.3) (2026-06-30)
 
 

package/lib/addressparser/index.js

@@ -1,5 +1,39 @@
 'use strict';
 
+/**
+ * Restores the quoting of a local part that was read out of a quoted string.
+ *
+ * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
+ * on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
+ * domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
+ * same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
+ * recipient separator once the consumer puts the address back into a header.
+ *
+ * This module has no dependencies so that it can ship on its own, which is why the two
+ * grammar tests below are spelled out here instead of shared with lib/mime-node. Keeping
+ * only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
+ * dot-atom rule on top of this when it emits an address.
+ *
+ * @param {String} address Address with an unquoted local part
+ * @return {String} Address with the local part as a quoted-string
+ */
+function _quoteLocalPart(address) {
+    const lastAt = address.lastIndexOf('@');
+    if (lastAt < 0) {
+        // no domain to split off, nothing can be misrouted
+        return address;
+    }
+
+    const user = address.substr(0, lastAt);
+    if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
+        // a local part that carries no special reads the same with or without the quotes,
+        // and one that is already a complete quoted-string needs nothing either
+        return address;
+    }
+
+    return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
+}
+
 /**
  * Converts tokens for a single address into an address object
  *
@@ -145,6 +179,10 @@ function _handleAddress(tokens, depth) {
             data.text = data.text.concat(data.address.splice(1));
         }
 
+        // An address is only taken from unquoted text, so anything left in the text at this
+        // point that still has to serve as the address carries its quoting in this flag
+        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
@@ -162,6 +200,10 @@ function _handleAddress(tokens, depth) {
             }
         }
 
+        if (addressFromQuotedText && address.address) {
+            address.address = _quoteLocalPart(address.address);
+        }
+
         addresses.push(address);
     }
 

package/lib/dkim/sign.js

@@ -50,15 +50,20 @@ module.exports = (headers, hashAlgo, bodyHash, options) => {
 module.exports.relaxedHeaders = relaxedHeaders;
 
 function generateDKIMHeader(domainName, keySelector, fieldNames, hashAlgo, bodyHash) {
+    // the caller supplied tag values are interpolated straight into the tag list, and none of
+    // them has any way to carry a control char, DEL, or one of the delimiters that would close
+    // the value and open a tag of its own
+    const cleanTagValue = value => (value || '').toString().replace(/[\x00-\x1f\x7f;=]/g, '');
+
     const dkim = [
         'v=1',
         'a=rsa-' + hashAlgo,
         'c=relaxed/relaxed',
-        'd=' + punycode.toASCII(domainName),
+        'd=' + punycode.toASCII(cleanTagValue(domainName)),
         'q=dns/txt',
-        's=' + keySelector,
+        's=' + cleanTagValue(keySelector),
         'bh=' + bodyHash,
-        'h=' + fieldNames
+        'h=' + cleanTagValue(fieldNames)
     ].join('; ');
 
     return mimeFuncs.foldLines('DKIM-Signature: ' + dkim, 76) + ';\r\n b=';

package/lib/json-transport/index.js

@@ -33,7 +33,7 @@ class JSONTransport {
         // Sendmail strips this header line by itself
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);

package/lib/mailer/mail-message.js

@@ -140,7 +140,7 @@ class MailMessage {
     }
 
     normalize(callback) {
-        const envelope = this.data.envelope || this.message.getEnvelope();
+        const envelope = this.message.getEnvelope();
         const messageId = this.message.messageId();
 
         this.resolveAll((err, data) => {
@@ -271,15 +271,16 @@ class MailMessage {
                         }
 
                         if (value && value.url) {
+                            // strip CR/LF so a comment can't inject extra header lines. DEL is neither
+                            // qtext nor ctext, so it can not be carried literally by either construct
+                            // and has to become an encoded word like any other non-plaintext value
+                            let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
+                            const needsEncoding = !mimeFuncs.isPlainText(comment) || /\x7f/.test(comment);
+
                             if (key.toLowerCase().trim() === 'id') {
-                                // List-ID: "comment" <domain>
-                                // strip CR/LF so a comment can't inject extra header lines
-                                let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
-                                if (mimeFuncs.isPlainText(comment)) {
-                                    comment = '"' + comment + '"';
-                                } else {
-                                    comment = mimeFuncs.encodeWord(comment);
-                                }
+                                // List-ID: "comment" <domain>, where an unescaped quote or a trailing
+                                // backslash in the comment would swallow the <domain> behind it
+                                comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
 
                                 // List-ID expects a bare domain-like identifier, so strip the
                                 // scheme prefix that _formatListUrl adds or passes through
@@ -289,11 +290,11 @@ class MailMessage {
                             }
 
                             // List-*: <http://domain> (comment)
-                            // strip CR/LF so a comment can't inject extra header lines
-                            let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
-                            if (!mimeFuncs.isPlainText(comment)) {
-                                comment = mimeFuncs.encodeWord(comment);
-                            }
+                            // the ctext specials go out as quoted-pairs, otherwise a ")" closes the
+                            // comment early and leaves the rest as junk, an unpaired "(" opens a
+                            // nested comment that never closes, and a trailing backslash escapes
+                            // the closing ")" so the comment swallows whatever follows it
+                            comment = needsEncoding ? mimeFuncs.encodeWord(comment) : comment.replace(/[()\\]/g, '\\$&');
 
                             return this._formatListUrl(value.url) + (value.comment ? ' (' + comment + ')' : '');
                         }
@@ -307,7 +308,9 @@ class MailMessage {
     }
 
     _formatListUrl(url) {
-        url = url.replace(/[\s<]+|[\s>]+/g, '');
+        // a url has no way to carry a control char or DEL, and the angle brackets around it
+        // are not a quoting construct, so anything left here lands in the header raw
+        url = url.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[\s<]+|[\s>]+/g, '');
         if (/^(https?|mailto|ftp):/.test(url)) {
             return '<' + url + '>';
         }

package/lib/mime-funcs/index.js

@@ -10,14 +10,33 @@ module.exports = {
     /**
      * Checks if a value is plaintext string (uses only printable 7bit chars)
      *
+     * When isParam is set the value is destined for a header parameter, so HT, CR and LF
+     * are not plaintext either: a header parameter has no way to carry them. HT is a valid
+     * fold point, so folding and unfolding a header would rewrite it as a space, and CR/LF
+     * cannot appear in a header value at all. DEL is neither a token character nor qtext,
+     * so it can not be carried bare or quoted. Such values have to go through the rfc2231
+     * parameter continuation encoding instead, the same way a quote already does.
+     *
      * @param {String} value String to be tested
+     * @param {Boolean} [isParam] Set to true if the value is a header parameter value
      * @returns {Boolean} true if it is a plaintext string
      */
     isPlainText(value, isParam) {
-        const re = isParam ? /[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
+        const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
         return typeof value === 'string' && !re.test(value);
     },
 
+    /**
+     * Wraps a value into a quoted-string. Inside one a quote would end the string early
+     * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
+     *
+     * @param {String} value String to be quoted
+     * @returns {String} The value as a quoted-string, quotes included
+     */
+    quoteString(value) {
+        return '"' + (value || '').toString().replace(/["\\]/g, '\\$&') + '"';
+    },
+
     /**
      * Checks if a multi line string containes lines longer than the selected value.
      *
@@ -80,8 +99,10 @@ module.exports = {
                 for (let i = 0, len = encodedStr.length; i < len; i++) {
                     let chr = encodedStr.charAt(i);
 
-                    if (/[\ud83c\ud83d\ud83e]/.test(chr) && i < len - 1) {
-                        // composite emoji byte, so add the next byte as well
+                    if (/[\ud800-\udbff]/.test(chr) && /[\udc00-\udfff]/.test(encodedStr.charAt(i + 1))) {
+                        // leading surrogate, so add the trailing surrogate as well
+                        // an unpaired one must not swallow the next unit, that would destroy
+                        // a valid pair following it
                         chr += encodedStr.charAt(++i);
                     }
 
@@ -168,10 +189,12 @@ module.exports = {
     buildHeaderValue(structured) {
         const paramsArray = [];
 
-        Object.keys(structured.params || {}).forEach(param => {
+        Object.keys(structured.params || {}).forEach(key => {
             // filename might include unicode characters so it is a special case
             // other values probably do not
-            const value = structured.params[param];
+            const value = structured.params[key];
+            // a parameter name is a token too and it is emitted without any quoting around it
+            const param = key.replace(/[\x00-\x1f\x7f]/g, '');
             if (!this.isPlainText(value, true) || value.length >= 75) {
                 this.buildHeaderParam(param, value, 50).forEach(encodedParam => {
                     if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
@@ -187,7 +210,11 @@ module.exports = {
             }
         });
 
-        return structured.value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
+        // the value ahead of the parameters is a token, it has no way to carry a control
+        // char or DEL and there is no quoting construct around it to escape one into
+        const value = typeof structured.value === 'string' ? structured.value.replace(/[\x00-\x1f\x7f]/g, '') : structured.value;
+
+        return value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
     },
 
     /**
@@ -208,7 +235,7 @@ module.exports = {
     buildHeaderParam(key, data, maxLength) {
         const list = [];
         let encodedStr = typeof data === 'string' ? data : (data || '').toString();
-        let chr, ord;
+        let chr;
         let line;
         let startPos = 0;
         let i, len;
@@ -245,8 +272,9 @@ module.exports = {
                 const encodedStrArr = [];
                 for (i = 0, len = encodedStr.length; i < len; i++) {
                     chr = encodedStr.charAt(i);
-                    ord = chr.charCodeAt(0);
-                    if (ord >= 0xd800 && ord <= 0xdbff && i < len - 1) {
+                    if (/[\ud800-\udbff]/.test(chr) && /[\udc00-\udfff]/.test(encodedStr.charAt(i + 1))) {
+                        // an unpaired leading surrogate must not consume the next unit, that
+                        // would tear apart a valid pair following it
                         chr += encodedStr.charAt(i + 1);
                         encodedStrArr.push(chr);
                         i++;
@@ -284,8 +312,11 @@ module.exports = {
                                 line,
                                 encoded
                             });
+                            // the line we start here holds an encoded char, so it has to be
+                            // flagged as one. otherwise it gets an unstarred continuation key
+                            // and a receiver reads the percent escapes as literal text
                             line = '';
-                            startPos = i - 1;
+                            encoded = true;
                         } else {
                             encoded = true;
                             i = startPos;
@@ -600,8 +631,11 @@ module.exports = {
             // might throw if we try to encode invalid sequences, eg. partial emoji
             str = encodeURIComponent(str);
         } catch (_E) {
-            // should never run
-            return str.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g, '');
+            // an unpaired surrogate has no utf-8 representation, so run the value through a
+            // utf-8 roundtrip to get the same U+FFFD every other encoder here produces and
+            // retry. the value must never come back unencoded, it goes into a header parameter
+            // where a bare quote or semicolon would break it out into a parameter of its own
+            str = encodeURIComponent(Buffer.from(str, 'utf-8').toString('utf-8'));
         }
 
         // ensure chars that are not handled by encodeURICompent are converted as well

package/lib/mime-node/index.js

@@ -21,6 +21,20 @@ const LeUnix = require('./le-unix');
 
 const FORMATTED_HEADERS = ['From', 'Sender', 'To', 'Cc', 'Bcc', 'Reply-To', 'Date', 'References'];
 
+// RFC 5321 atext, plus the non-ascii bytes that SMTPUTF8 (RFC 6531) adds to it. A local part
+// built from these, with '.' as a separator, is a dot-atom and can be emitted bare
+const ATEXT = "[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]";
+const DOT_ATOM = new RegExp('^' + ATEXT + '+(?:\\.' + ATEXT + '+)*$');
+
+// A complete quoted-string: everything between the outer quotes is either a plain char or
+// a quoted-pair. Anchored, so a value that only starts and ends with a quote does not pass
+const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
+
+// An address that carries no special anywhere can be emitted bare in a header, everything
+// else goes into angle brackets so that the header can not be read as more addresses than
+// the envelope carries
+const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -552,6 +566,11 @@ class MimeNode {
                 case 'Content-Type':
                     structured = mimeFuncs.parseHeaderValue(value);
 
+                    // the type token decides multipart and charset below, so clean it before
+                    // those run and not just on the way out, otherwise a control char makes
+                    // the checks miss and the header ends up claiming a type it is not set up for
+                    structured.value = (structured.value || '').toString().replace(/[\x00-\x1f\x7f]/g, '');
+
                     this._handleContentType(structured);
 
                     if (
@@ -568,11 +587,18 @@ class MimeNode {
                         // add support for non-compliant clients like QQ webmail
                         // we can't build the value with buildHeaderValue as the value is non standard and
                         // would be converted to parameter continuation encoding that we do not want
-                        param = this._encodeWords(this.filename);
+                        // control chars can not be quoted here: HT is a fold point that unfolding would
+                        // turn into a space, CR/LF can not appear in a header at all and DEL is not
+                        // qtext, so force the mime encoded word that a non-ascii filename would get anyway
+                        param = /[\x00-\x1f\x7f]/.test(this.filename)
+                            ? mimeFuncs.encodeWord(this.filename, this._getTextEncoding(this.filename), 52)
+                            : this._encodeWords(this.filename);
 
                         if (param !== this.filename || /[\s'"\\;:/=(),<>@[\]?]|^-/.test(param)) {
-                            // include value in quotes if needed
-                            param = '"' + param + '"';
+                            // include value in quotes if needed, escaping backslashes and quotes as
+                            // quoted-pairs exactly like buildHeaderValue does for filename=, otherwise
+                            // a trailing backslash would escape the closing quote
+                            param = JSON.stringify(param);
                         }
                         value += '; name=' + param;
                     }
@@ -595,8 +621,12 @@ class MimeNode {
 
             if (typeof this.normalizeHeaderKey === 'function') {
                 const normalized = this.normalizeHeaderKey(key, value);
-                if (normalized && typeof normalized === 'string' && normalized.length) {
-                    key = normalized;
+                // the result replaces the key on the way into the header, so it gets the same
+                // treatment the key it replaces already had. a line break here would end the
+                // header and start one of the caller's own
+                const cleaned = typeof normalized === 'string' ? normalized.replace(/[\x00-\x1f\x7f]/g, '') : '';
+                if (cleaned) {
+                    key = cleaned;
                 }
             }
 
@@ -837,7 +867,7 @@ class MimeNode {
 
         if (envelope.from) {
             list = [];
-            this._convertAddresses(this._parseAddresses(envelope.from), list);
+            this._convertAddresses(this._parseEnvelopeAddresses(envelope.from), list);
             list = list.filter(address => address && address.address);
             if (list.length && list[0]) {
                 this._envelope.from = list[0].address;
@@ -845,7 +875,7 @@ class MimeNode {
         }
         ['to', 'cc', 'bcc'].forEach(key => {
             if (envelope[key]) {
-                this._convertAddresses(this._parseAddresses(envelope[key]), this._envelope.to);
+                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to);
             }
         });
 
@@ -1034,15 +1064,67 @@ class MimeNode {
             [],
             [].concat(addresses).map(address => {
                 if (address && address.address) {
-                    address.address = this._normalizeAddress(address.address);
-                    address.name = address.name || '';
-                    return [address];
+                    const normalized = this._normalizeAddress(address.address);
+                    if (normalized === address.address && typeof address.name === 'string') {
+                        // there is nothing to rewrite, so there is nothing to keep off the original
+                        return [address];
+                    }
+
+                    // rewriting would land on the object the caller passed in and might
+                    // still hold a reference to, so rewrite a copy of it instead
+                    const copy = Object.assign({}, address);
+                    copy.address = normalized;
+                    copy.name = address.name || '';
+                    return [copy];
                 }
-                return addressparser(address);
+                return this._normalizeParsedAddresses(addressparser(address));
             })
         );
     }
 
+    /**
+     * Normalizes the addresses of a freshly parsed address list, groups included.
+     *
+     * Everything this method returns carries a normalized address, whether it arrived as an
+     * object or was parsed out of a header value. Without this the two shapes disagree, and
+     * a consumer reading the parsed form back is handed the ambiguous
+     * 'user@evil.com@good.com' that the header and the envelope no longer carry.
+     *
+     * @param {Array} parsed An array of address objects, as returned by addressparser
+     * @return {Array} The same array, with every address normalized
+     */
+    _normalizeParsedAddresses(parsed) {
+        // addressparser builds these objects, so no caller holds a reference to rewrite around
+        parsed.forEach(entry => {
+            if (entry.address) {
+                entry.address = this._normalizeAddress(entry.address);
+            } else if (entry.group) {
+                this._normalizeParsedAddresses(entry.group);
+            }
+        });
+
+        return parsed;
+    }
+
+    /**
+     * Parses the addresses of an explicitly set envelope.
+     *
+     * An envelope value is an addr-spec and never a display name, so a bare local username
+     * such as 'root' is the address here. Header parsing has to read the same value as a
+     * display name, as a value with no '@' in it can not be an addr-spec in a header.
+     *
+     * @param {Mixed} addresses Addresses to be parsed
+     * @return {Array} An array of address objects
+     */
+    _parseEnvelopeAddresses(addresses) {
+        return this._parseAddresses(addresses).map(entry => {
+            if (entry.address || entry.group || !entry.name || /[\s@]/.test(entry.name)) {
+                return entry;
+            }
+            return { address: this._normalizeAddress(entry.name), name: '' };
+        });
+    }
+
     /**
      * Normalizes a header key, uses Camel-Case form, except for uppercase MIME-
      *
@@ -1054,6 +1136,9 @@ class MimeNode {
             .toString()
             // no newlines in keys
             .replace(/\r?\n|\r/g, ' ')
+            // a field name is printable ascii without the colon, so a control char or DEL
+            // can only be dropped, there is no quoting construct around a field name
+            .replace(/[\x00-\x1f\x7f]/g, '')
             .trim()
             .toLowerCase()
             // use uppercase words, except MIME
@@ -1114,7 +1199,13 @@ class MimeNode {
             case 'Message-ID':
             case 'In-Reply-To':
             case 'Content-Id':
-                value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
+                // a msg-id is structured, so an encoded word inside the angle brackets would
+                // be read as literal text. drop the characters that can not appear in a header
+                // at all, but leave HT alone, it separates the ids of a multi id value
+                value = (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
 
                 if (value.charAt(0) !== '<') {
                     value = '<' + value;
@@ -1134,6 +1225,7 @@ class MimeNode {
                             elm = (elm || '')
                                 .toString()
                                 .replace(/\r?\n|\r/g, ' ')
+                                .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                                 .trim();
                             return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
                         })
@@ -1156,7 +1248,7 @@ class MimeNode {
                 }
 
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
 
             case 'Content-Type':
             case 'Content-Disposition':
@@ -1165,8 +1257,7 @@ class MimeNode {
 
             default:
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                // encodeWords only encodes if needed, otherwise the original string is returned
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
         }
     }
 
@@ -1187,7 +1278,11 @@ class MimeNode {
                 address.address = this._normalizeAddress(address.address);
 
                 if (!address.name) {
-                    values.push(address.address.indexOf(' ') >= 0 ? `<${address.address}>` : `${address.address}`);
+                    // an address that carries a special, be it a quoted local part or a domain
+                    // that could not be normalized, is only unambiguous inside angle brackets.
+                    // Without them a ',' or a ';' anywhere in it reads as a recipient separator
+                    // and the header would list more recipients than the envelope carries
+                    values.push(PLAIN_ADDRESS.test(address.address) ? address.address : `<${address.address}>`);
                 } else {
                     values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
@@ -1213,19 +1308,26 @@ class MimeNode {
     _normalizeAddress(address) {
         address = (address || '')
             .toString()
-            .replace(/[\x00-\x1F<>]+/g, ' ') // remove unallowed characters
+            .replace(/[\x00-\x1F\x7F<>]+/g, ' ') // remove unallowed characters
             .trim();
 
+        if (!address) {
+            // callers use an empty value to detect a missing address
+            return address;
+        }
+
         const lastAt = address.lastIndexOf('@');
         if (lastAt < 0) {
-            // Bare username
-            return address;
+            // Bare username, there is no domain to split off
+            return this._normalizeLocalPart(address);
         }
 
-        let user = address.substr(0, lastAt);
+        const user = address.substr(0, lastAt);
         const domain = address.substr(lastAt + 1);
 
-        // Usernames are not touched and are kept as is even if these include unicode.
+        // Unicode in the local part is kept as is, see _normalizeLocalPart for the rest of it.
+        // A domain has no quoting construct to fall back on, so whatever is not a valid domain
+        // is kept as supplied and it is _convertAddresses that keeps such an address unambiguous.
         // Domains are punycoded when the local part is ASCII ('safe@jõgeva.ee' -> 'safe@xn--jgeva-dua.ee').
         // When the local part contains non-ASCII bytes the address already requires SMTPUTF8,
         // so the domain is kept (or decoded back) as UTF-8 for symmetry on both sides of '@'.
@@ -1242,16 +1344,27 @@ class MimeNode {
             // keep domain as supplied
         }
 
-        if (user.indexOf(' ') >= 0) {
-            if (user.charAt(0) !== '"') {
-                user = '"' + user;
-            }
-            if (user.substr(-1) !== '"') {
-                user = user + '"';
-            }
+        return `${this._normalizeLocalPart(user)}@${encodedDomain}`;
+    }
+
+    /**
+     * Normalizes the local part of an address into a form that can be emitted as is.
+     *
+     * A local part is either a dot-atom or a quoted-string, anything else is not a valid
+     * addr-spec. The quotes of a quoted local part get lost along the way, and a bare
+     * 'user@evil.com@good.com' leaves it to the receiver which '@' splits the domain off,
+     * while the split here is always at the last one. So whatever is not already one of
+     * the two valid forms goes back out as a quoted-string.
+     *
+     * @param {String} user Local part of an address
+     * @return {String} Local part as a dot-atom or as a quoted-string
+     */
+    _normalizeLocalPart(user) {
+        if (DOT_ATOM.test(user) || QUOTED_STRING.test(user)) {
+            return user;
         }
 
-        return `${user}@${encodedDomain}`;
+        return mimeFuncs.quoteString(user);
     }
 
     /**
@@ -1263,7 +1376,7 @@ class MimeNode {
     _encodeAddressName(name) {
         if (!/^[\w ]*$/.test(name)) {
             if (/^[\x20-\x7e]*$/.test(name)) {
-                return '"' + name.replace(/([\\"])/g, '\\$1') + '"';
+                return mimeFuncs.quoteString(name);
             } else {
                 return mimeFuncs.encodeWord(name, this._getTextEncoding(name), 52);
             }
@@ -1271,6 +1384,21 @@ class MimeNode {
         return name;
     }
 
+    /**
+     * Encodes an unstructured header value. Such a value can only carry VCHAR and WSP, so a
+     * control char or DEL has to be forced into the mime encoded word that a non-ascii value
+     * would get anyway. HT stays as it is, it is valid folding whitespace here.
+     *
+     * @param {String} value Header value to encode
+     * @returns {String} Mime word encoded string if needed
+     */
+    _encodeHeaderText(value) {
+        return /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)
+            ? mimeFuncs.encodeWord(value, this._getTextEncoding(value), 52)
+            : // encodeWords only encodes if needed, otherwise the original string is returned
+              this._encodeWords(value);
+    }
+
     /**
      * If needed, mime encodes the name part
      *

package/lib/punycode/index.js

@@ -250,7 +250,7 @@ const decode = function (input) {
     // Main decoding loop: start just after the last delimiter if any basic code
     // points were copied; start at the beginning otherwise.
 
-    for (let index = basic > 0 ? basic + 1 : 0; index < inputLength /* no final expression */; ) {
+    for (let index = basic > 0 ? basic + 1 : 0; index < inputLength /* no final expression */;) {
         // `index` is the index of the next character to be consumed.
         // Decode a generalized variable-length integer into `delta`,
         // which gets added to `i`. The overflow checking is easier

package/lib/sendmail-transport/index.js

@@ -62,14 +62,17 @@ class SendmailTransport {
         // Sendmail strips this header line by itself
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
         let returned;
 
         const hasInvalidAddresses = []
             .concat(envelope.from || [])
             .concat(envelope.to || [])
-            .some(addr => /^-/.test(addr));
+            // a local part is either a dot-atom or a quoted-string, so a leading dash sits at
+            // offset 0 or, behind the opening quote, at offset 1. Only the first shape is read
+            // as an option by sendmail, but both are the address this guard keeps out of argv
+            .some(addr => /^"?-/.test(addr));
         if (hasInvalidAddresses) {
             const err = new Error('Can not send mail. Invalid envelope addresses.');
             err.code = errors.ESENDMAIL;

package/lib/ses-transport/index.js

@@ -66,7 +66,7 @@ class SESTransport extends EventEmitter {
             fromHeader = mimeNode._convertAddresses(mimeNode._parseAddresses(fromHeader.value));
         }
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);

package/lib/stream-transport/index.js

@@ -42,7 +42,7 @@ class StreamTransport {
         // We probably need this in the output
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);

package/lib/well-known/services.json

@@ -577,6 +577,20 @@
         "port": 587
     },
 
+    "TurboSMTP": {
+        "description": "TurboSMTP",
+        "host": "pro.turbo-smtp.com",
+        "port": 465,
+        "secure": true
+    },
+
+    "TurboSMTP-EU": {
+        "description": "TurboSMTP (EU region)",
+        "host": "pro.eu.turbo-smtp.com",
+        "port": 465,
+        "secure": true
+    },
+
     "Tutanota": {
         "description": "Tutanota (Tuta Mail)",
         "domains": ["tutanota.com", "tuta.com", "tutanota.de", "tuta.io"],

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "9.0.3",
+    "version": "9.0.5",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,19 +27,19 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1068.0",
+        "@aws-sdk/client-sesv2": "3.1104.0",
         "bunyan": "1.8.15",
-        "c8": "11.0.0",
-        "eslint": "10.5.0",
+        "c8": "12.0.0",
+        "eslint": "10.8.0",
         "eslint-config-prettier": "10.1.8",
-        "globals": "17.6.0",
+        "globals": "17.9.0",
         "libbase64": "1.3.0",
-        "libmime": "5.3.8",
+        "libmime": "5.4.1",
         "libqp": "2.1.1",
-        "prettier": "3.8.4",
+        "prettier": "3.9.6",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.0"
+        "smtp-server": "3.19.2"
     },
     "engines": {
         "node": ">=6.0.0"