Nylas Blocks Message Fields From Injecting Extra Email Headers

Nylas said message and draft fields can no longer be used to inject extra MIME headers into an outgoing email, in an Oct. 22 changelog entry. The fix sits among a long list of email, calendar and Scheduler repairs in the same release.

Message and draft fields are now sanitized

Nylas listed the header fix under its Email section as one line: message and draft fields “are now sanitized so they can no longer be used to inject extra MIME headers into an outgoing email.”

Header injection works by slipping a line break into a value. The text after the break is read as a new header, such as a hidden recipient.

Failed sends no longer leave drafts behind

Failed sends through Microsoft Graph no longer leave an orphaned draft, Nylas said. Tracked links in a retried send keep working. Workflow sends through Graph no longer fail a permission scope check when a grant’s scopes are formatted differently but are otherwise equivalent. Gmail reply sends and draft creation no longer fail when Nylas can’t immediately read the new message back to verify it. Nylas said the send or draft still completes.

Draft writes on IMAP grants that hit a lock conflict now return a retryable 503 instead of an error that couldn’t be retried. Saving a draft on an IMAP grant now falls back to STARTTLS when verifying the saved copy. That fixes drafts that failed on providers requiring STARTTLS instead of a direct TLS connection.

Inbound mail and error messages improved

Inbound messages with non-UTF-8 text are no longer dropped during sync, Nylas said. It now stores the text as received. Transient failures while saving an inbound message are retried automatically. SMTP send errors now report the port Nylas used when the port fallback also fails.

Key takeaways

• Nylas sanitizes message and draft fields so they can’t add MIME headers.
• Microsoft Graph, Gmail and IMAP send paths each got a fix.
• Inbound mail with non-UTF-8 text is now kept instead of dropped.

The take

We think the header fix matters more than its one-line billing suggests. Header injection is an old bug class. It works when a program trusts text that came from outside. The safe habit is to clean every value before it becomes part of a message.

Teams that build subjects, names or addresses from user input should test each field with a line break and confirm it is rejected or stripped. Keep your own input checks too. A platform fix covers one platform.