Your security advisory has been quite helpful and I could reproduce the issue involving CR. It is particularly enlightening to know that the null byte could also cause the same issue because some IRC servers may interpret the null byte too as a line ending.

It is late here but I have pushed a quick fix to plug this loophole: <https://github.com/susam/nimb/commit/1c02137>. Review comments, feedback, pull requests, patches, etc. are very welcome! Thank you for this comment thread which has been constructive as well as productive.