Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34752 Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__ https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34752
Post summary
CVE-2026-34752 impacts Haraka mail server before version 3.1.4; the text only hints at the issue and that newer releases likely contain the fix, with no PoC or exploit details provided.
CVE-2026-34752 Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patc… https://www.cve.org/CVERecord?id=CVE-2026-34752
Post summary
Haraka workers crash when an email contains a "__proto__:" header; the issue is already patched before version 3.1.4.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haraka_project | haraka | - | node.js | - |