CVE-2026-34752 Haraka affected by DoS via `__proto__` email header
An attacker can crash the Haraka mail server worker process by sending an email with a specific header, requiring a patch to restore service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34752?
CVE-2026-34752 is a high-severity denial of service vulnerability in Haraka, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.
Weakness: CWE-248
Which versions are affected by CVE-2026-34752?
2 open source packages ship an affected version, including Haraka. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Haraka npm | All versions | 3.1.4 |
Haraka npm | All versions | 3.1.4 |
Products include Haraka Project Haraka.
How do I fix CVE-2026-34752?
Upgrade Haraka to 3.1.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34752 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34752 exists.
Other vulnerabilities in Haraka
Sources
Also known as GHSA-xph3-r2jf-4vp3.