Question 1

What is email header injection?

Accepted Answer

Email header injection is a CRLF-injection flaw where a web form builds raw email headers (To, From, Subject) from user input. If the input contains carriage-return/line-feed sequences, the attacker starts new header lines — adding Bcc/Cc recipients, forging the Subject or Content-Type, or splitting the body — because the mail system treats each line as a separate header.

Question 2

What can an attacker do with it?

Accepted Answer

They can smuggle hidden copies of every message to arbitrary addresses (Bcc), turn a plain contact form into a spam relay, spoof the apparent subject or sender, or inject HTML content by forging a Content-Type header. It's a common way to abuse 'contact us' and 'invite a friend' features.

Question 3

How do I prevent email header injection?

Accepted Answer

Reject or strip carriage-return and line-feed characters from any value that becomes a header, and never hand-build header strings — pass structured fields to a mailer library (nodemailer, SendGrid) that encodes headers and refuses embedded newlines. Validate email addresses against a strict format that leaves no room for extra headers.

Email Header Injection

Challenges

Frequently Asked Questions