# What changed in libmime

> 8 changes in libmime 5 from its official release notes, upgrade guides and advisories: 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/libmime/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## libmime 5

### Security

- Header parsing was hardened against prototype pollution and parser differentials. (5.4.2) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.2)

### New APIs and options

- Exposes normalizeCharset() on the public API. (5.4.0) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.0)

### Performance

- Long non-ASCII words are encoded in linear time, improving encoding performance. (5.4.9) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.9)
- Flowed decoding and header unfolding now run in linear time. (5.4.5) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.5)

### Fixes and other changes

- RFC 2231 parameters are marked as decoded. (5.4.9) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.9)
- Transfer-encoding codecs are refused when used as charsets. (5.4.9) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.9)
- B-encoded words are decoded through libbase64. (5.4.6) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.4.6)
- charset.decode returns a string for Japanese encodings. (5.3.8) — [release notes](https://github.com/nodemailer/libmime/releases/tag/v5.3.8)