2.89.0 (2026-11-15)
Summary
This release fixes a memory leak in the IMAP workers that made a busy instance grow by hundreds of MB an hour, and raises the minimum Node.js version to 22.19, which the fix requires. It also includes a security fix in ImapFlow for hostile IMAP servers and a dependency refresh across the mail parsing stack.
Who should upgrade
- Everyone on 2.82.0 or later who fetches messages with
webSafeHtmlorpreProcessHtml: every rendered message stayed in the IMAP worker heap for the life of the process. - Everyone who connects accounts to IMAP servers they do not control (user-supplied hosts): a crafted SEARCH or BODYSTRUCTURE answer could exhaust the worker heap (GHSA-g78f-3cr8-fhw5).
Breaking changes / action required
- Node.js 22.19 is now the minimum when EmailEngine runs from npm or source. On an older Node.js release EmailEngine refuses to start and prints the commands to upgrade (including for NodeSource installs such as the DigitalOcean droplet). A Node.js release between 22.19 and the supported range (
^22.22.2 || ^24.15.0 || >=26.0.0) starts with a warning, and the dashboard and upgrade page say so. - The prebuilt binaries and the Docker image bundle Node.js 24 and need no action.
Highlights
- IMAP worker heap no longer grows with every message rendered as web-safe HTML (jsdom 31 and juice 12 in
@postalsys/email-text-tools3.0). - If the HTML sanitizer ever fails to load, web-safe HTML falls back to escaped plain text instead of failing every request.
- ImapFlow 2.12.1 bounds the memory a SEARCH answer or a BODYSTRUCTURE can take, whatever the server sends.
- A newly registered subscription key is checked soon instead of waiting for the replaced key's schedule, up to a day later.
- Quoted-printable content is decoded as it arrives instead of being buffered whole (libqp 3.0.2), lowering memory use when parsing large messages.
- Dependency updates: nodemailer 10.6.0, mailparser 3.14.4, libmime 5.6.5, smtp-server 3.21.5, undici 8.
Bug Fixes
- check a newly registered subscription key soon instead of on the replaced key's schedule (07e0512)
- stop the IMAP workers retaining every web-safe HTML message, require Node.js 22.19 (8b0bc06)
- update dependencies (1e08d01)
Miscellaneous Chores
- release 2.89.0 (ac15c96)