CVE-2026-34752: Haraka Mail Server DOS Vulnerability

CVE-2026-34752 Overview

CVE-2026-34752 is a Denial of Service vulnerability affecting Haraka, a popular Node.js mail server. The vulnerability allows remote attackers to crash Haraka worker processes by sending specially crafted emails containing __proto__ as a header name. This prototype pollution attack vector exploits how JavaScript handles object property assignment, causing the server to terminate unexpectedly when processing malicious email headers.

Critical Impact

Remote unauthenticated attackers can crash Haraka mail server worker processes, causing service disruption and potential mail delivery failures across the organization.

Affected Products

• Haraka Node.js Mail Server versions prior to 3.1.4

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34752 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34752

Vulnerability Analysis

This vulnerability stems from improper handling of email header names in Haraka's mail processing logic. When an email is received with __proto__ used as a header name, the server attempts to process this as a standard header property. In JavaScript, __proto__ is a special property that references an object's prototype, and direct manipulation of this property can lead to prototype pollution or, in this case, an uncaught exception that crashes the worker process.

The vulnerability is classified under CWE-248 (Uncaught Exception), indicating that the application fails to properly handle the exception raised when processing the malicious header. The network-accessible attack vector means that any external actor capable of sending emails to the Haraka server can trigger the crash without requiring authentication.

Root Cause

The root cause is the absence of input validation and sanitization for email header names before they are processed as object properties in JavaScript. The Haraka mail server does not filter or escape special JavaScript property names like __proto__, constructor, or prototype when parsing incoming email headers. When the __proto__ header is encountered, it triggers prototype pollution behavior that the application cannot handle gracefully, resulting in an uncaught exception and worker process termination.

Attack Vector

The attack can be executed remotely over the network by any attacker capable of sending SMTP traffic to the vulnerable Haraka server. The attacker constructs a malicious email with the header name set to __proto__ and sends it to the target mail server. Upon receiving and processing this email, the Haraka worker process crashes.

The attack requires no authentication, no user interaction, and has low complexity. The attacker simply needs network access to the SMTP port (typically port 25, 465, or 587) of the vulnerable Haraka instance. Each malicious email sent will crash a worker process, and repeated attacks can effectively deny mail service to legitimate users.

Detection Methods for CVE-2026-34752

Indicators of Compromise

• Unexpected crashes or restarts of Haraka worker processes in system logs
• SMTP connections containing emails with __proto__ or similar prototype pollution strings in header names
• Increased frequency of worker process spawn events indicating repeated crashes
• Error logs showing uncaught exceptions related to object property handling

Detection Strategies

• Configure mail gateway logs to alert on emails containing __proto__, constructor, or __defineGetter__ in header names
• Monitor Haraka process stability using process managers like PM2 or systemd, alerting on abnormal restart patterns
• Implement SMTP traffic inspection rules to identify and flag malicious header patterns before they reach the mail server
• Review application logs for stack traces indicating prototype pollution or uncaught exception errors

Monitoring Recommendations

• Enable verbose logging in Haraka to capture detailed information about incoming email headers during incident investigation
• Set up real-time alerting for Haraka worker process crashes using monitoring solutions like Prometheus, Datadog, or similar
• Monitor SMTP connection rates and correlate spikes with process instability events
• Implement baseline metrics for normal worker process lifecycle and alert on deviations

How to Mitigate CVE-2026-34752

Immediate Actions Required

• Upgrade Haraka to version 3.1.4 or later immediately, as this version contains the patch for this vulnerability
• Review recent mail server logs for evidence of exploitation attempts using __proto__ headers
• Consider temporarily implementing upstream mail filtering to block emails with suspicious header patterns while patching is scheduled
• Ensure worker process supervisors are configured to restart crashed processes to maintain service availability during the upgrade window

Patch Information

The vulnerability has been addressed in Haraka version 3.1.4. The patch adds proper input validation and sanitization for email header names, preventing special JavaScript properties from causing prototype pollution or uncaught exceptions. Organizations should upgrade to this version or later by following the release notes available at the GitHub Haraka Release v3.1.4. Additional details about the vulnerability and fix can be found in the GitHub Security Advisory GHSA-xph3-r2jf-4vp3.

Workarounds

• Deploy a mail relay or proxy in front of Haraka that sanitizes or rejects emails with __proto__ or other JavaScript-sensitive strings in header names
• Implement rate limiting on SMTP connections to reduce the impact of repeated crash attempts
• Configure network-level filtering to restrict SMTP access to trusted sources while awaiting the patch deployment
• Use process supervision tools to automatically restart crashed Haraka workers, minimizing downtime during an attack

# Upgrade Haraka to patched version
npm update haraka@3.1.4

# Verify installed version
npm list haraka

# Restart Haraka service after upgrade
systemctl restart haraka