Executive brief
Haraka is a high-performance email server built on Node.js. A vulnerability in how the server handles email headers allows an attacker to crash the service by sending a specially crafted email. This results in a denial-of-service, potentially stopping all email delivery or dropping active connections.
Technical details
A denial-of-service vulnerability exists in Haraka's header parsing logic within 'haraka-email-message'. The parser uses a plain JavaScript object to store headers. When an email is received with the header name '__proto__', the code attempts to access and modify the object's prototype property. Specifically, it tries to call a '.push()' method on 'Object.prototype', which results in a TypeError. Because this exception is not caught within the worker context, it triggers the global uncaughtException handler and terminates the process. In single-process mode, this shuts down the server; in cluster mode, it crashes the worker and terminates all active sessions. The issue is resolved in version 3.1.4 by ensuring more robust header handling.
Affected products
- Haraka Project Haraka < 3.1.4
Timeline
- 2026-03-30: patched: Version 3.1.4 released
- 2026-03-30: advisory: GitHub Security Advisory GHSA-xph3-r2jf-4vp3 published
- 2026-04-02: disclosed: CVE-2026-34752 published to NVD