CVE-2026-34752: Haraka DoS Vulnerability via __proto__ Email Header
Summary
CVE-2026-34752: Haraka affected by DoS via proto email header. Affects Haraka versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Haraka is a high-performance email server built on Node.js, designed for handling large volumes of email efficiently. It offers features such as plugin support, SMTP support, and is widely used for its speed and flexibility. However, it is susceptible to a Denial of Service (DoS) attack due to improper handling of email headers, specifically when the proto header is used.
Vulnerability Detail
The vulnerability arises from the way Haraka processes email headers. When an email is sent with __proto: as a header, the header parser mistakenly uses Object.prototype, leading to a TypeError when attempting to call a method on it. This results in the Haraka worker process crashing. In single-process mode, this causes the entire server to go down, while in cluster mode, the master restarts the worker but loses all active sessions. The vulnerability is classified as high severity with a CVSS score of 8.7.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
npm install Haraka@3.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sending emails with proto as a header. Additionally, you can implement input validation to filter out such headers before they reach the Haraka server.
Conclusion
In summary, CVE-2026-34752 is a critical vulnerability in Haraka that can lead to Denial of Service attacks through the misuse of the proto email header. It is essential to update to the latest version to mitigate this risk and ensure the stability of your email server.
See every vulnerability recorded for Haraka →
FAQ
The impact includes potential downtime of the Haraka server, leading to loss of email processing capabilities and active sessions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in version 3.1.4 of Haraka. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, implement input validation to filter out the proto header from incoming emails as a temporary measure.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for Haraka.
