# What changed in mailparser

> 16 changes in mailparser 3 from its official release notes, upgrade guides and advisories: 4 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/mailparser/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mailparser 3

### Security

- Bounds scanning of untrusted text bodies. (3.9.16) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.16)
- Prevents RFC 2047 encoded words from fabricating addresses during address decoding. (3.9.4) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.4)
- mailparser vulnerable to Cross-site Scripting (3.9.3) — [security advisory](https://github.com/advisories/GHSA-7GMJ-H9XC-MCXC)
- URLs and link text are now escaped to prevent XSS. (3.9.3) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.3)

### Fixes and other changes

- A decoded display name is no longer turned into an address. (3.9.40) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.40)
- The message is kept when its HTML cannot be converted to text. (3.9.40) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.40)
- An unavailable checksum algorithm is reported as a parser error. (3.9.33) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.33)
- Honours backpressure when handling attachments. (3.9.30) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.30)
- Caps inlined CID images. (3.9.30) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.30)
- Reports errors from the splitter that occur late. (3.9.30) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.30)
- Derives partId from the part number. (3.9.30) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.30)
- Ensures settlement happens only once. (3.9.30) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.30)
- Declares the Node 20 minimum requirement that the package already had, helping developers identify the required runtime. (3.9.22) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.22)
- Decode iso-8859-8-i and iso-8859-8-e charsets as iso-8859-8. (3.9.12) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.12)
- False values are filtered from empty References headers. (3.9.4) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.4)
- Parsing of unquoted commas in display names is fixed, so addresses with those display names can be parsed correctly. (3.9.4) — [release notes](https://github.com/nodemailer/mailparser/releases/tag/v3.9.4)