CVE-2026-34752

HIGH

Haraka affected by DoS via `__proto__` email header

Title source: cna

Description

Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.

References (2)

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 16.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-248
Status published
Products (3)
haraka/Haraka < 3.1.4
haraka_project/haraka < 3.1.4
npm/Haraka 0 - 3.1.4npm
Published Apr 02, 2026
Tracked Since Apr 03, 2026