diff --git a/src/helpers.ts b/src/helpers.ts
index 1b45aa2..765ad77 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -129,6 +129,12 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
 
     // Convert value to string
     const stringValue = String(value)
+
+    // Validate header value to prevent CRLF/header injection
+    if (stringValue.includes('\r') || stringValue.includes('\n')) {
+      core.warning(`Skipping header "${name}" because its value contains newline characters, which are not allowed in HTTP header values.`)
+      continue
+    }
     validHeaders[name] = stringValue
 
     // Mask sensitive headers in logs