CVE-2026-34752

Published April 2nd, 2026

View on NVD ↗

CVSS v3

7.5

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.

haraka/Haraka

A fast, highly extensible, and event driven SMTP server

GitHub

5.57K