postal-mime is an email parsing library for Node.js, web browsers (including Web Workers), and serverless environments (such as Cloudflare Email Workers). It parses raw RFC822 email data into a structured object with headers, recipients, attachments, and more, including support for complex MIME parts and nested multiparts.
Project status
- Actively maintained: upstream pushed and updated the project on 2026-10-29, just days before today.
- Recent updates came in a dense burst, with several updates from 2026-10-17 through 2026-10-29. That shows recent activity, but not a longer-term cadence.
AI summary generated
Recent updates
v4.2.0
v4.2.0 adds parsing of the experimental OTP-Token email header and exposes the resulting passcode and bound origin as `email.otp`. The diff shows no removed APIs, signature changes, or dependency updates.
Featuresv4.1.4
Postal Mime v4.1.4 focuses on parser correctness and safer handling of malformed or unusual email input, including stricter header termination, charset handling, MIME boundaries, and forwarded messages. It also improves formatting performance and rejects an invalid zero part-count limit; no public API signatures or exports appear to change.
Securityv4.1.3
v4.1.3 is a targeted fix in the charset decoding logic, adjusting when a byte order mark (BOM) is allowed to influence UTF-16 endianness. The release notes describe restricting BOM honor behavior to UTF-16 labels that leave the byte order open.
v4.1.2
v4.1.2 is a small patch release that focuses on improving how structured header text is copied during parsing. The release notes describe a bug fix that copies characters as runs rather than one at a time.
v4.1.1
v4.1.1 is a patch release focused on correctness and security fixes in MIME parsing, especially around charset decoding, header and boundary parsing, encoded-word handling, and HTML handling. It also includes a performance-related change to render nested inline forward text only once at the root level.
Securityv4.1.0
v4.1.0 adds structured error codes to errors thrown by the parser, enabling callers to identify failure causes without parsing error messages. The change introduces a new errors module and updates limit and validation checks to throw errors that include a stable `code` property.
Featuresv4.0.11
v4.0.11 is a bug fix release focused on how the address parser reads RFC 5322 address groups. The change updates group parsing to occur in the same pass as the rest of the list, improving correctness and performance characteristics for complex group nesting scenarios.
v4.0.10
v4.0.10 is presented as a bug fix release focused on making the address parser more memory efficient. The changes revolve around how parsed tokens are represented and reused when converting an address list into individual address objects.
v4.0.9
v4.0.9 is a bugfix release focused on making the address parser more RFC-correct in tricky cases, especially around angle-addr parsing, comments, whitespace (CFWS) handling near '@', and nested group depth limits. It also includes additional test coverage for edge cases that previously caused incorrect parsing or excessive parsing work.
v4.0.8
v4.0.8 fixes correctness and performance issues in encoded-word decoding and tightens resource accounting for nested inline message/rfc822 forwards. The parser now counts certain budgets across the whole message, including inline forwarded messages, and improves base64 join handling to avoid expensive pad checks.
Breakingv4.0.7
v4.0.7 focuses on fixing performance and resource exhaustion issues in flowed text unfolding and HTML to text conversion, plus bounding output for inline forwarded message/rfc822 headers. It introduces a new parsing limit, maxForwardedAddresses, to cap how many From, To, Cc, and Bcc addresses are rendered across all inline forwards. Several tests were added to ensure the new limits and linear-time behavior hold.
SecurityFeaturesv4.0.6
v4.0.6 primarily fixes a base64 decoding memory issue by buffering decoded output in fixed-size chunks, addressing issue #107. The implementation refactors both Base64Decoder and QPDecoder to use a new internal ChunkWriter utility for chunked output collection.
Breakingv4.0.5
v4.0.5 focuses on correctness and robustness improvements to MIME parsing and text decoding. The main behavioral changes include stricter handling of malformed inputs (HTML, encoded words, HTML entities) and improved preservation of original line endings for binary and non-binary parts.
SecurityFeaturesv4.0.4
v4.0.4 fixes multipart parsing around RFC 2046 5.1.1 line break ownership, specifically addressing incorrect inclusion of the CRLF before a multipart boundary as part content. The code changes implement a boundary-aware “pending line break” mechanism across MIME node finalization and transfer-encoding decoders.
v4.0.3
v4.0.3 contains parsing bug fixes focused on Structured Header parameter handling in multipart Content-Type and Content-Disposition values. The documented fixes address preventing continuations from overriding a plain parameter, and ensuring junk after a closed quoted string does not cause the parser to drop the entire message body.
v4.0.2
v4.0.2 is a small bug fix release focused on RFC 5322 tokenization of domain-literals (IPv6 address literals) involving the '[' character. The release notes state that a '[' no longer hides operators after it. Code changes indicate the fix required more specific parsing rule changes than what is documented.
v4.0.1
v4.0.1 focuses on bug fixes in the email address parsing logic, especially around encoded words and correct handling of domain literals. The release notes mention specific edge cases, but the code diff shows a much larger internal rewrite of src/address-parser.ts plus a sizable addition of Nodemailer-derived test coverage.
v4.0.0
v4.0.0 is a major refactor that converts the library to TypeScript and ships updated ESM and CommonJS builds. The release notes also include a Node.js upgrade requirement and a typing change for `Attachment.disposition`, plus an ESM entry point relocation.
BreakingFeaturesv3.0.1
v3.0.1 focuses on fixing and hardening several parsing and conversion paths to avoid quadratic-time behavior on large inputs. The changes target address parsing, header trimming/unfolding, decoded-word address detection, and HTML-to-text conversion, with additional internal optimizations in charset decoding and decoder reuse.
v3.0.0
v3.0.0 introduces more RFC 5322 compliant header unfolding and duplicated-header resolution, with documented changes to whitespace handling and which duplicated headers win (first occurrence). The implementation also contains several decoding, security hardening, and ordering changes that are not covered in the release notes.
BreakingSecurity