npm / mailparser
mailparser
What changed in mailparser 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
4 security12 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmailparser 316 changes
Security 4
Bounds scanning of untrusted text bodies.
Prevents RFC 2047 encoded words from fabricating addresses during address decoding.
mailparser vulnerable to Cross-site Scripting
URLs and link text are now escaped to prevent XSS.
Fixes and other changes 12
A decoded display name is no longer turned into an address.
The message is kept when its HTML cannot be converted to text.
An unavailable checksum algorithm is reported as a parser error.
Honours backpressure when handling attachments.
Caps inlined CID images.
Reports errors from the splitter that occur late.
Derives partId from the part number.
Ensures settlement happens only once.
Declares the Node 20 minimum requirement that the package already had, helping developers identify the required runtime.
Decode iso-8859-8-i and iso-8859-8-e charsets as iso-8859-8.
False values are filtered from empty References headers.
Parsing of unquoted commas in display names is fixed, so addresses with those display names can be parsed correctly.