Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-34752

Haraka affected by DoS via `__proto__` email header

Description

Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

haraka Haraka

  • < 3.1.4affected

References