nodemailer 9.0.4 → 9.0.6

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # CHANGELOG
 
+## [9.0.6](https://github.com/nodemailer/nodemailer/compare/v9.0.5...v9.0.6) (2026-08-27)
+
+
+### Bug Fixes
+
+* **addressparser:** recover the addr-spec from an angle-addr holding whitespace ([e989a22](https://github.com/nodemailer/nodemailer/commit/e989a22ca4f5161929bf37be8fb07de635016fa7))
+* harden copies of user supplied keys and URL fetching ([2f667f4](https://github.com/nodemailer/nodemailer/commit/2f667f4272cb2d7cb479b2e3903ab10600fc0eae))
+
+## [9.0.5](https://github.com/nodemailer/nodemailer/compare/v9.0.4...v9.0.5) (2026-08-07)
+
+
+### Bug Fixes
+
+* **ci:** retrigger the workflows dropped during the Actions outage ([85d16c1](https://github.com/nodemailer/nodemailer/commit/85d16c103ec69e237c7e55c0e3103f439c135ce3))
+* **mailer:** escape specials in List-* header comments ([#1842](https://github.com/nodemailer/nodemailer/issues/1842)) ([75913bb](https://github.com/nodemailer/nodemailer/commit/75913bba032623046dd7fa037b8b880e388d8357))
+* **mime-funcs:** star the continuation key of a restarted parameter line ([36bcf1a](https://github.com/nodemailer/nodemailer/commit/36bcf1a21a92b5a283c780e35aacd3080292d98d))
+* **mime-node:** keep control chars out of header values and msg-id headers ([15cf6d1](https://github.com/nodemailer/nodemailer/commit/15cf6d1c15cdf60f551618fd54fb727ea7aac94c))
+* **mime:** encode DEL in header parameters and List-* comments ([cf69430](https://github.com/nodemailer/nodemailer/commit/cf69430ffac1d246bfbab564daf321f31ed9e1dd))
+* **mime:** keep control chars out of the remaining header positions ([5ed9d26](https://github.com/nodemailer/nodemailer/commit/5ed9d26f85eecb48f4b3ae74ad33ed2abf002040))
+* **mime:** normalize an address parsed out of a string as well ([63685f7](https://github.com/nodemailer/nodemailer/commit/63685f7dd4aefa75cc72a36f983f32f61cd6733e))
+* **mime:** normalize an address so header and envelope agree ([a9343b4](https://github.com/nodemailer/nodemailer/commit/a9343b47e42b9ccb27911ad8e73d4119c6170c85))
+* **mime:** stop a header key callback and the dkim tags from injecting ([b7d772e](https://github.com/nodemailer/nodemailer/commit/b7d772ea4ec12ee82e65a9b919af882bf0f125d9))
+
 ## [9.0.4](https://github.com/nodemailer/nodemailer/compare/v9.0.3...v9.0.4) (2026-08-04)
 
 

package/README.md

@@ -8,10 +8,7 @@ Send emails from Node.js – easy as cake! 🍰✉️
 
 See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
-> [!TIP]
-> Check out **[EmailEngine](https://emailengine.app/?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link)** – a self-hosted email gateway that allows making **REST requests against IMAP and SMTP servers**. EmailEngine also sends webhooks whenever something changes on the registered accounts.\
-> \
-> Using the email accounts registered with EmailEngine, you can receive and [send emails](https://emailengine.app/sending-emails?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link). EmailEngine supports OAuth2, delayed sends, opens and clicks tracking, bounce detection, etc. All on top of regular email accounts without an external MTA service.
+> Nodemailer is developed by the team behind **[EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs)**, a self-hosted email API that turns any Gmail, Microsoft 365, or IMAP account into a REST endpoint, with managed OAuth2, webhooks for incoming mail, and built-in [sending](https://emailengine.app/sending-emails?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs). If you would rather call an HTTP API than maintain IMAP and SMTP connections yourself, that is what it is for.
 
 ## Having an issue?
 
@@ -25,7 +22,7 @@ You are using an older Node.js version than v6.0. Upgrade Node.js to get support
 
 #### I'm having issues with Gmail
 
-Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/).
+Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/). If the blocker is OAuth2 setup rather than Gmail itself, [EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs&utm_content=faq-gmail) handles the OAuth2 flow and token refresh for you.
 
 #### I get ETIMEDOUT errors
 

package/lib/addressparser/index.js

@@ -1,5 +1,134 @@
 'use strict';
 
+/**
+ * Restores the quoting of a local part that was read out of a quoted string.
+ *
+ * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
+ * on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
+ * domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
+ * same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
+ * recipient separator once the consumer puts the address back into a header.
+ *
+ * This module has no dependencies so that it can ship on its own, which is why the two
+ * grammar tests below are spelled out here instead of shared with lib/mime-node. Keeping
+ * only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
+ * dot-atom rule on top of this when it emits an address.
+ *
+ * @param {String} address Address with an unquoted local part
+ * @return {String} Address with the local part as a quoted-string
+ */
+function _quoteLocalPart(address) {
+    const lastAt = address.lastIndexOf('@');
+    if (lastAt < 0) {
+        // no domain to split off, nothing can be misrouted
+        return address;
+    }
+
+    const user = address.substr(0, lastAt);
+    if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
+        // a local part that carries no special reads the same with or without the quotes,
+        // and one that is already a complete quoted-string needs nothing either
+        return address;
+    }
+
+    return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
+}
+
+/**
+ * Reached for every parsed address, so it is built once rather than per call.
+ */
+const HAS_WHITESPACE = /\s/;
+
+/**
+ * An addr-spec that carries its whitespace legally, inside a quoted local part. The
+ * optional tail is the malformed shape: a real mailbox with wreckage trailing it.
+ */
+const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
+
+/**
+ * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
+ */
+const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+
+/**
+ * The looser reading applied once the strict one finds nothing, which tolerates the
+ * further '@' that a domain should not have but malformed headers carry anyway.
+ */
+const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+
+/**
+ * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
+ *
+ * A malformed header can put more than a mailbox between the angle brackets, most often
+ * because the generator wrote the recipient twice: '<user@example.com user@example.com>'
+ * or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
+ * never be a mailbox anyone could deliver to, and passing it on as the address loses the
+ * recipient that is sitting right there in the header.
+ *
+ * The run that still reads as an addr-spec is kept and whatever is left over becomes
+ * display text rather than being dropped. Candidates are read strictly first and then
+ * under the looser grammar, the same two tiers the unquoted-text branch below applies to
+ * the same problem, so that '<a@b@c.com junk>' and a bare 'a@b@c.com junk' agree on the
+ * recipient. When several runs qualify the first wins, which is what that branch's looser
+ * tier does within a token.
+ *
+ * A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
+ * '<"user name"@example.com>' is well formed and means exactly what it says.
+ *
+ * @param {Object} data Collected address parts, mutated in place
+ */
+function _recoverAddrSpec(data) {
+    if (!HAS_WHITESPACE.test(data.address)) {
+        return;
+    }
+
+    let address;
+    let rest;
+
+    const quoted = data.address.match(QUOTED_LOCAL_ADDR);
+    if (quoted) {
+        if (!quoted[2]) {
+            // the whitespace sits inside the quoted local part, this is a well formed mailbox
+            return;
+        }
+
+        // a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
+        // than splitting into the quotes
+        address = quoted[1];
+        rest = [quoted[2]];
+    } else {
+        if (data.address.indexOf('"') >= 0) {
+            // Splitting on whitespace loses track of where the quoted string starts and ends,
+            // and this module does not take addresses out of quoted strings: the run picked out
+            // of '<junk "user@evil.com b"@good.com>' would be an address from the domain the
+            // quotes were hiding. Every well formed shape was already handled above, so what is
+            // left is wreckage either way and the original is the honest answer
+            return;
+        }
+
+        const parts = data.address.split(/\s+/);
+
+        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        if (addrIndex < 0) {
+            addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
+        }
+
+        if (addrIndex < 0) {
+            // nothing in there reads as an address, there is no better answer than the original
+            return;
+        }
+
+        address = parts.splice(addrIndex, 1)[0];
+        rest = parts;
+    }
+
+    data.address = address;
+    data.text = [data.text]
+        .concat(rest)
+        .filter(part => part)
+        .join(' ');
+}
+
 /**
  * Converts tokens for a single address into an address object
  *
@@ -103,7 +232,7 @@ function _handleAddress(tokens, depth) {
                 // Security: Do not extract email addresses from quoted strings.
                 // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
                 // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                if (!data.textWasQuoted[i] && /^[^@\s]+@[^@\s]+$/.test(data.text[i])) {
+                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
                     data.address = data.text.splice(i, 1);
                     data.textWasQuoted.splice(i, 1);
                     break;
@@ -145,10 +274,16 @@ function _handleAddress(tokens, depth) {
             data.text = data.text.concat(data.address.splice(1));
         }
 
+        // An address is only taken from unquoted text, so anything left in the text at this
+        // point that still has to serve as the address carries its quoting in this flag
+        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
 
+        _recoverAddrSpec(data);
+
         const address = {
             address: data.address || data.text || '',
             name: data.text || data.address || ''
@@ -162,6 +297,10 @@ function _handleAddress(tokens, depth) {
             }
         }
 
+        if (addressFromQuotedText && address.address) {
+            address.address = _quoteLocalPart(address.address);
+        }
+
         addresses.push(address);
     }
 

package/lib/dkim/index.js

@@ -10,6 +10,7 @@ const { PassThrough } = require('stream');
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { copyOwnKeys } = require('../shared/objects');
 
 const DKIM_ALGO = 'sha256';
 const MAX_MESSAGE_SIZE = 2 * 1024 * 1024; // buffer messages larger than this to disk
@@ -225,7 +226,11 @@ class DKIM {
 
         let options = this.options;
         if (extraOptions && Object.keys(extraOptions).length) {
-            options = Object.assign({}, extraOptions, this.options);
+            // extraOptions is mail.data._dkim, caller supplied message data. An own
+            // "__proto__" key there would let every option this signer reads and the
+            // transport did not set, such as skipFields, answer from the caller
+            options = copyOwnKeys({}, extraOptions);
+            copyOwnKeys(options, this.options);
         }
 
         const signer = new DKIMSigner(options, this.keys, inputStream, output);

package/lib/dkim/sign.js

@@ -50,15 +50,20 @@ module.exports = (headers, hashAlgo, bodyHash, options) => {
 module.exports.relaxedHeaders = relaxedHeaders;
 
 function generateDKIMHeader(domainName, keySelector, fieldNames, hashAlgo, bodyHash) {
+    // the caller supplied tag values are interpolated straight into the tag list, and none of
+    // them has any way to carry a control char, DEL, or one of the delimiters that would close
+    // the value and open a tag of its own
+    const cleanTagValue = value => (value || '').toString().replace(/[\x00-\x1f\x7f;=]/g, '');
+
     const dkim = [
         'v=1',
         'a=rsa-' + hashAlgo,
         'c=relaxed/relaxed',
-        'd=' + punycode.toASCII(domainName),
+        'd=' + punycode.toASCII(cleanTagValue(domainName)),
         'q=dns/txt',
-        's=' + keySelector,
+        's=' + cleanTagValue(keySelector),
         'bh=' + bodyHash,
-        'h=' + fieldNames
+        'h=' + cleanTagValue(fieldNames)
     ].join('; ');
 
     return mimeFuncs.foldLines('DKIM-Signature: ' + dkim, 76) + ';\r\n b=';

package/lib/fetch/index.js

@@ -9,9 +9,67 @@ const Cookies = require('./cookies');
 const packageData = require('../../package.json');
 const net = require('net');
 const errors = require('../errors');
+const { isProtoKey } = require('../shared/objects');
 
 const MAX_REDIRECTS = 5;
 
+// Only genuine TLS settings are taken from options.tls. That object reaches us straight
+// from a user supplied attachment (content.tls), so keys like host, port, path, socketPath
+// or lookup would otherwise repoint the request at a destination that never went through
+// the URL checks below.
+//
+// The source of truth is the tls.connect() option list in the Node docs. A key missing
+// here is dropped silently, so extend this list rather than working around it.
+const TLS_OPTION_KEYS = [
+    'ALPNProtocols',
+    'ca',
+    'cert',
+    'checkServerIdentity',
+    'ciphers',
+    'crl',
+    'dhparam',
+    'ecdhCurve',
+    'honorCipherOrder',
+    'key',
+    'maxVersion',
+    'minVersion',
+    'passphrase',
+    'pfx',
+    'rejectUnauthorized',
+    'secureContext',
+    'secureOptions',
+    'secureProtocol',
+    'servername',
+    'sessionIdContext',
+    'sigalgs'
+];
+
+/**
+ * Resolves a URL only if it is one this module is willing to request.
+ *
+ * urllib.parse throws for a host that contains forbidden bytes, and it is called for
+ * every URL that reaches nmfetch, including ones that arrive from a message attachment
+ * or from a redirect Location header. An uncaught throw here takes the process down,
+ * so a URL that does not parse is reported the same way as one with a scheme we refuse.
+ *
+ * @param {String} url URL to parse
+ * @returns {Object|Boolean} Parsed URL, or false if it is not a usable http(s) URL
+ */
+function parseFetchUrl(url) {
+    let parsed;
+    try {
+        parsed = urllib.parse(url);
+    } catch (_err) {
+        return false;
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return false;
+    }
+
+    return parsed;
+}
+
 module.exports = function (url, options) {
     return nmfetch(url, options);
 };
@@ -26,6 +84,30 @@ function nmfetch(url, options) {
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
 
+    const fetchRes = options.fetchRes;
+    const parsed = parseFetchUrl(url);
+
+    if (!parsed) {
+        // Only http(s) URLs can be fetched. Any other scheme (file:, gopher:, a
+        // protocol-relative redirect target etc.) would otherwise be silently served over
+        // plain HTTP, possibly against an unintended host. Bail out before the cookie jar
+        // is touched so a refused URL can not seed it, and release a caller supplied body:
+        // this is the one exit that runs before the error handler below is attached to it,
+        // so an error on that stream would have nowhere to go and the fd or socket behind
+        // it would never be released.
+        if (options.body && typeof options.body.destroy === 'function') {
+            options.body.on('error', () => false);
+            options.body.destroy();
+        }
+        setImmediate(() => {
+            const err = new Error('Unsupported protocol for URL ' + url);
+            err.code = errors.EFETCH;
+            err.sourceUrl = url;
+            fetchRes.emit('error', err);
+        });
+        return fetchRes;
+    }
+
     if (options.cookie) {
         [].concat(options.cookie || []).forEach(cookie => {
             options.cookies.set(cookie, url);
@@ -33,8 +115,6 @@ function nmfetch(url, options) {
         options.cookie = false;
     }
 
-    const fetchRes = options.fetchRes;
-    const parsed = urllib.parse(url);
     let method = (options.method || '').toString().trim().toUpperCase() || 'GET';
     let finished = false;
     let cookies;
@@ -48,6 +128,10 @@ function nmfetch(url, options) {
     };
 
     Object.keys(options.headers || {}).forEach(key => {
+        // options.headers is the caller's httpHeaders, straight off an attachment
+        if (isProtoKey(key.toLowerCase().trim())) {
+            return;
+        }
         headers[key.toLowerCase().trim()] = options.headers[key];
     });
 
@@ -131,7 +215,12 @@ function nmfetch(url, options) {
     };
 
     if (options.tls) {
-        Object.assign(reqOptions, options.tls);
+        // see TLS_OPTION_KEYS
+        Object.keys(options.tls).forEach(key => {
+            if (TLS_OPTION_KEYS.includes(key)) {
+                reqOptions[key] = options.tls[key];
+            }
+        });
     }
 
     if (
@@ -216,8 +305,29 @@ function nmfetch(url, options) {
             options.method = 'GET';
             options.body = false;
 
-            const redirectUrl = urllib.resolve(url, res.headers.location);
-            const redirectParsed = urllib.parse(redirectUrl);
+            let redirectUrl;
+            try {
+                redirectUrl = urllib.resolve(url, res.headers.location);
+            } catch (_err) {
+                // the legacy resolver throws on a Location the WHATWG parser also refused,
+                // so fall through to the check below with what the server actually sent
+                redirectUrl = res.headers.location;
+            }
+            const redirectParsed = parseFetchUrl(redirectUrl);
+
+            if (!redirectParsed) {
+                // Refuse the redirect target here rather than leaving it to the recursive
+                // call: that call gets its own `finished` flag and no handle on this
+                // request, so this one would stay open and could emit a second error on
+                // the shared fetchRes once it times out. Callers listen with req.once().
+                finished = true;
+                const err = new Error('Unsupported protocol for URL ' + redirectUrl);
+                err.code = errors.EFETCH;
+                err.sourceUrl = redirectUrl;
+                fetchRes.emit('error', err);
+                req.abort();
+                return;
+            }
 
             // Do not forward credentials when the redirect leaves the original
             // security context: a different host, or a downgrade from https to

package/lib/json-transport/index.js

@@ -33,7 +33,7 @@ class JSONTransport {
         // Sendmail strips this header line by itself
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);

package/lib/mail-composer/index.js

@@ -4,7 +4,7 @@
 
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
-const { parseDataURI } = require('../shared');
+const { parseDataURI, copyOwnKeys } = require('../shared');
 
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -205,7 +205,9 @@ class MailComposer {
                 typeof this.mail.icalEvent === 'object' &&
                 (this.mail.icalEvent.content || this.mail.icalEvent.path || this.mail.icalEvent.href || this.mail.icalEvent.raw)
             ) {
-                icalEvent = Object.assign({}, this.mail.icalEvent);
+                // an own "__proto__" key would make the copy inherit path/href from caller
+                // data, and the mapping below then replaces the content the caller did set
+                icalEvent = copyOwnKeys({}, this.mail.icalEvent);
             } else {
                 icalEvent = {
                     content: this.mail.icalEvent
@@ -600,7 +602,7 @@ class MailComposer {
             }
 
             // Return empty content for excessively long data URLs
-            return Object.assign({}, element, {
+            return Object.assign(copyOwnKeys({}, element), {
                 path: false,
                 href: false,
                 content: Buffer.alloc(0),

package/lib/mailer/mail-message.js

@@ -4,6 +4,11 @@ const shared = require('../shared');
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
 
+// Only an own key counts as already set. `key in obj` also matches every member of
+// Object.prototype, which silently drops a transporter default legitimately named
+// toString or constructor.
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 class MailMessage {
     constructor(mailer, data) {
         this.mailer = mailer;
@@ -14,23 +19,16 @@ class MailMessage {
         const options = mailer.options || {};
         const defaults = mailer._defaults || {};
 
-        Object.assign(this.data, data);
+        shared.copyOwnKeys(this.data, data);
 
         this.data.headers = this.data.headers || {};
 
-        // apply defaults
-        Object.keys(defaults).forEach(key => {
-            if (!(key in this.data)) {
-                this.data[key] = defaults[key];
-            } else if (key === 'headers') {
-                // headers is a special case. Allow setting individual default headers
-                Object.keys(defaults.headers).forEach(key => {
-                    if (!(key in this.data.headers)) {
-                        this.data.headers[key] = defaults.headers[key];
-                    }
-                });
-            }
-        });
+        // Apply defaults. `_defaults` is caller supplied too, it is the second argument of
+        // createTransport, so it needs the same treatment as `data` above
+        shared.copyOwnKeys(this.data, defaults, key => hasOwn(this.data, key));
+
+        // headers is a special case. Allow setting individual default headers
+        shared.copyOwnKeys(this.data.headers, defaults.headers, key => hasOwn(this.data.headers, key));
 
         // force specific keys from transporter options
         ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey'].forEach(key => {
@@ -123,11 +121,12 @@ class MailMessage {
                         content: value
                     };
                     if (args[0][args[1]] && typeof args[0][args[1]] === 'object' && !Buffer.isBuffer(args[0][args[1]])) {
-                        Object.keys(args[0][args[1]]).forEach(key => {
-                            if (!(key in node) && !['content', 'path', 'href', 'raw'].includes(key)) {
-                                node[key] = args[0][args[1]][key];
-                            }
-                        });
+                        // The keys are the caller's, so copying them takes the same "__proto__"
+                        // rule as the constructor. `key in node` stays as the already-set test
+                        // here, unlike for the defaults: it also skips the Object.prototype
+                        // member names, and letting message data land a `toString` string on a
+                        // node only buys a TypeError the first time something stringifies it.
+                        shared.copyOwnKeys(node, args[0][args[1]], key => key in node || ['content', 'path', 'href', 'raw'].includes(key));
                     }
 
                     args[0][args[1]] = node;
@@ -140,7 +139,7 @@ class MailMessage {
     }
 
     normalize(callback) {
-        const envelope = this.data.envelope || this.message.getEnvelope();
+        const envelope = this.message.getEnvelope();
         const messageId = this.message.messageId();
 
         this.resolveAll((err, data) => {
@@ -186,6 +185,9 @@ class MailMessage {
 
             data.normalizedHeaders = {};
             Object.keys(data.headers || {}).forEach(key => {
+                if (shared.isProtoKey(key)) {
+                    return;
+                }
                 let value = [].concat(data.headers[key] || []).shift();
                 value = (value && value.value) || value;
                 if (value) {
@@ -271,15 +273,16 @@ class MailMessage {
                         }
 
                         if (value && value.url) {
+                            // strip CR/LF so a comment can't inject extra header lines. DEL is neither
+                            // qtext nor ctext, so it can not be carried literally by either construct
+                            // and has to become an encoded word like any other non-plaintext value
+                            let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
+                            const needsEncoding = !mimeFuncs.isPlainText(comment) || /\x7f/.test(comment);
+
                             if (key.toLowerCase().trim() === 'id') {
-                                // List-ID: "comment" <domain>
-                                // strip CR/LF so a comment can't inject extra header lines
-                                let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
-                                if (mimeFuncs.isPlainText(comment)) {
-                                    comment = '"' + comment + '"';
-                                } else {
-                                    comment = mimeFuncs.encodeWord(comment);
-                                }
+                                // List-ID: "comment" <domain>, where an unescaped quote or a trailing
+                                // backslash in the comment would swallow the <domain> behind it
+                                comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
 
                                 // List-ID expects a bare domain-like identifier, so strip the
                                 // scheme prefix that _formatListUrl adds or passes through
@@ -289,11 +292,11 @@ class MailMessage {
                             }
 
                             // List-*: <http://domain> (comment)
-                            // strip CR/LF so a comment can't inject extra header lines
-                            let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
-                            if (!mimeFuncs.isPlainText(comment)) {
-                                comment = mimeFuncs.encodeWord(comment);
-                            }
+                            // the ctext specials go out as quoted-pairs, otherwise a ")" closes the
+                            // comment early and leaves the rest as junk, an unpaired "(" opens a
+                            // nested comment that never closes, and a trailing backslash escapes
+                            // the closing ")" so the comment swallows whatever follows it
+                            comment = needsEncoding ? mimeFuncs.encodeWord(comment) : comment.replace(/[()\\]/g, '\\$&');
 
                             return this._formatListUrl(value.url) + (value.comment ? ' (' + comment + ')' : '');
                         }
@@ -307,7 +310,9 @@ class MailMessage {
     }
 
     _formatListUrl(url) {
-        url = url.replace(/[\s<]+|[\s>]+/g, '');
+        // a url has no way to carry a control char or DEL, and the angle brackets around it
+        // are not a quoting construct, so anything left here lands in the header raw
+        url = url.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[\s<]+|[\s>]+/g, '');
         if (/^(https?|mailto|ftp):/.test(url)) {
             return '<' + url + '>';
         }