PT-2026-29673 · Haraka · Haraka

Sebastianosrt · Published 2026-04-01 · Updated 2026-04-03 · CVE-2026-34752

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Haraka versions prior to 3.1.4

Description Haraka, a Node.js mail server, is susceptible to a crash when processing emails containing the ' proto ': header. This occurs because the header parser stores headers in a plain object, and when the key is ' proto ', it attempts to call the 'push' function on the Object prototype, resulting in a TypeError. In single-process mode, this crash terminates the entire server. In cluster mode, the master process restarts the worker, leading to session loss.

Recommendations Update Haraka to version 3.1.4 or later.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-34752

GHSA-XPH3-R2JF-4VP3

Affected Products

Haraka

References · 7

• https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34752 · Security Note
• https://osv.dev/vulnerability/GHSA-xph3-r2jf-4vp3 · Vendor Advisory
• https://github.com/haraka/Haraka · Note
• https://github.com/haraka/Haraka/releases/tag/v3.1.4 · Note
• https://twitter.com/CVEnew/status/2040128782598643974 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2039915454961991714 · Twitter Post