postal-mime 2.6.0 → 2.6.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [2.6.1](https://github.com/postalsys/postal-mime/compare/v2.6.0...v2.6.1) (2025-11-26)
+
+
+### Bug Fixes
+
+* prevent DoS from deeply nested address groups ([f509eaf](https://github.com/postalsys/postal-mime/commit/f509eafec31bf448482133041c086f7aefa2b3fa))
+* update TypeScript typings to match source code ([df5640a](https://github.com/postalsys/postal-mime/commit/df5640a3166b0a1fe3ca563e1364301bb4e6a025))
+
 ## [2.6.0](https://github.com/postalsys/postal-mime/compare/v2.5.0...v2.6.0) (2025-10-24)
 
 

package/dist/address-parser.cjs

@@ -22,7 +22,7 @@ __export(address_parser_exports, {
 });
 module.exports = __toCommonJS(address_parser_exports);
 var import_decode_strings = require("./decode-strings.cjs");
-function _handleAddress(tokens) {
+function _handleAddress(tokens, depth) {
   let isGroup = false;
   let state = "text";
   let address;
@@ -90,7 +90,7 @@ function _handleAddress(tokens) {
     data.text = data.text.join(" ");
     let groupMembers = [];
     if (data.group.length) {
-      let parsedGroup = addressParser(data.group.join(","));
+      let parsedGroup = addressParser(data.group.join(","), { _depth: depth + 1 });
       parsedGroup.forEach((member) => {
         if (member.group) {
           groupMembers = groupMembers.concat(member.group);
@@ -258,8 +258,13 @@ class Tokenizer {
     this.escaped = false;
   }
 }
+const MAX_NESTED_GROUP_DEPTH = 50;
 function addressParser(str, options) {
   options = options || {};
+  let depth = options._depth || 0;
+  if (depth > MAX_NESTED_GROUP_DEPTH) {
+    return [];
+  }
   let tokenizer = new Tokenizer(str);
   let tokens = tokenizer.tokenize();
   let addresses = [];
@@ -279,7 +284,7 @@ function addressParser(str, options) {
     addresses.push(address);
   }
   addresses.forEach((address2) => {
-    address2 = _handleAddress(address2);
+    address2 = _handleAddress(address2, depth);
     if (address2.length) {
       parsedAddresses = parsedAddresses.concat(address2);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "postal-mime",
-    "version": "2.6.0",
+    "version": "2.6.1",
     "description": "Email parser for browser environments",
     "main": "./dist/postal-mime.cjs",
     "module": "./src/postal-mime.js",
@@ -37,14 +37,14 @@
     "author": "Andris Reinman",
     "license": "MIT-0",
     "devDependencies": {
-        "@types/node": "24.0.4",
+        "@types/node": "24.10.1",
         "cross-blob": "3.0.2",
-        "cross-env": "7.0.3",
-        "esbuild": "^0.25.11",
+        "cross-env": "10.1.0",
+        "esbuild": "0.27.0",
         "eslint": "8.57.0",
         "eslint-cli": "1.1.1",
         "iframe-resizer": "4.3.6",
-        "prettier": "^3.6.2",
-        "typescript": "^5.9.3"
+        "prettier": "3.6.2",
+        "typescript": "5.9.3"
     }
 }

package/postal-mime.d.ts

@@ -2,6 +2,7 @@ export type RawEmail = string | ArrayBuffer | Uint8Array | Blob | Buffer | Reada
 
 export type Header = {
     key: string;
+    originalKey: string;
     value: string;
 };
 
@@ -27,7 +28,7 @@ export type Attachment = {
     description?: string;
     contentId?: string;
     method?: string;
-    content: ArrayBuffer | string;
+    content: ArrayBuffer | Uint8Array | string;
     encoding?: "base64" | "utf8";
 };
 

package/src/address-parser.js

@@ -4,9 +4,10 @@ import { decodeWords } from './decode-strings.js';
  * Converts tokens for a single address into an address object
  *
  * @param {Array} tokens Tokens object
+ * @param {Number} depth Current recursion depth for nested group protection
  * @return {Object} Address object
  */
-function _handleAddress(tokens) {
+function _handleAddress(tokens, depth) {
     let isGroup = false;
     let state = 'text';
     let address;
@@ -87,7 +88,7 @@ function _handleAddress(tokens) {
         // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
         let groupMembers = [];
         if (data.group.length) {
-            let parsedGroup = addressParser(data.group.join(','));
+            let parsedGroup = addressParser(data.group.join(','), { _depth: depth + 1 });
             // Flatten: if any member is itself a group, extract its members into the sequence
             parsedGroup.forEach(member => {
                 if (member.group) {
@@ -307,6 +308,13 @@ class Tokenizer {
     }
 }
 
+/**
+ * Maximum recursion depth for parsing nested groups.
+ * RFC 5322 doesn't allow nested groups, so this is a safeguard against
+ * malicious input that could cause stack overflow.
+ */
+const MAX_NESTED_GROUP_DEPTH = 50;
+
 /**
  * Parses structured e-mail addresses from an address field
  *
@@ -319,10 +327,18 @@ class Tokenizer {
  *     [{name: 'Name', address: 'address@domain'}]
  *
  * @param {String} str Address field
+ * @param {Object} options Optional options object
+ * @param {Number} options._depth Internal recursion depth counter (do not set manually)
  * @return {Array} An array of address objects
  */
 function addressParser(str, options) {
     options = options || {};
+    let depth = options._depth || 0;
+
+    // Prevent stack overflow from deeply nested groups (DoS protection)
+    if (depth > MAX_NESTED_GROUP_DEPTH) {
+        return [];
+    }
 
     let tokenizer = new Tokenizer(str);
     let tokens = tokenizer.tokenize();
@@ -347,7 +363,7 @@ function addressParser(str, options) {
     }
 
     addresses.forEach(address => {
-        address = _handleAddress(address);
+        address = _handleAddress(address, depth);
         if (address.length) {
             parsedAddresses = parsedAddresses.concat(address);
         }