e-mail in node crashes runtime with uncaught IMAP exception when userid/password are missing

[fordkan]

Which node are you reporting and issue on?

The e-mail in node logs missing userid/password during construction, but does not prevent the node from starting or calling imap.connect(). With missing/decrypt-failed credentials, node-imap raises “No supported authentication method(s) available. Unable to login.” In Node-RED 4.1.11 / Node.js 22 this can surface as an uncaught exception and crash the runtime.

Expected behaviour:
If credentials are missing, the node should set red status, call node.error(), and not attempt an IMAP connection. Missing credentials should not crash the Node-RED process.

The key issue is this:

When credentials are missing, the node logs an error:

this.error(RED.("email.errors.nouserid"));
this.error(RED.("email.errors.nopassword"));

…but it does not stop the node from continuing. It still later builds the IMAP connection using:

imap = new Imap({
user: node.userid,
password: node.password,
host: node.inserver,
...
});

Then it eventually calls:

imap.connect();

So if node.userid and node.password are undefined/blank, it still tries to connect anyway. That matches your log exactly:

[e-mail in:Incoming Email] No e-mail userid set
[e-mail in:Incoming Email] No e-mail password set
...
No supported authentication method(s) available. Unable to login.

The current 61-email.js source shows that missing userid/password are reported with this.error(...), but there is no immediate return, disable, or guard that prevents checkIMAP() from running later. It also auto-starts the node on deploy/startup with node.emit("input", {}) when the node has no input wire, which means the bad credential state can trigger immediately at boot.

The underlying imap library then throws/returns the specific authentication error when it cannot find a usable auth method. Its code checks for XOAUTH/XOAUTH2, then checks whether both user and password exist, and otherwise creates the error:

No supported authentication method(s) available

That is the exact error your crash log shows.

Where it should probably be handled better

In plain terms, the email node should probably do something like this during setup:

if (this.authtype !== "NONE" && !this.userid) {
this.error(RED._("email.errors.nouserid"));
this.status({ fill: "red", shape: "ring", text: "missing userid" });
return;
}

if (this.authtype === "BASIC" && !this.password) {
this.error(RED._("email.errors.nopassword"));
this.status({ fill: "red", shape: "ring", text: "missing password" });
return;
}

or inside checkIMAP() before constructing new Imap(...):

if (node.authtype === "BASIC" && (!node.userid || !node.password)) {
node.status({ fill: "red", shape: "ring", text: "missing credentials" });
node.error("Missing e-mail username or password");
setInputRepeatTimeout();
safeDone(new Error("Missing e-mail username or password"));
return;
}

The important part is: do not call imap.connect() when credentials are missing.

What are the steps to reproduce?

Mail Nodes with blank credentials

What happens?

Node-RED version: v4.1.11
Node.js version: v22.22.3

[e-mail in:Incoming Email] No e-mail userid set
[e-mail in:Incoming Email] No e-mail password set
[red] Uncaught Exception:
Error: No supported authentication method(s) available. Unable to login.
at Connection. (/data/node_modules/imap/lib/Connection.js:1679:15)

What did you expect to happen?

NOT CRASH NODE RED ENTIRELY

Example flow

paste your flow here

Environment

App Version: 4.1.11-18
Version: 1.4.13

• npm version:
• Platform/OS: truenas
• Browser: chrome