#nodejs

Email Header Injection in 2026, Still Trivial — and I Found It in My Own Contact Form

Your contact form takes a name, an email, and a message. Three fields. Two of them can take over your mail server if you let them. A short tour of an attack that's older than I am, and how I found it in code I'd just shipped.

• #security
• #nodejs
• #email
• #war-stories