CVE-2026-34752: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34752 is a Denial of Service (DoS) vulnerability in Haraka, a Node.js mail server, caused by improper handling of the __proto__ email header name. Sending an email with __proto__: as a header name triggers an uncaught exception that crashes the Haraka worker process. All versions up to and including 3.1.3 are affected; the issue was patched in version 3.1.4. The advisory was first published on March 30, 2026, and added to the GitHub Advisory Database on April 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Haraka Advisory).

The root cause is an uncaught exception (CWE-248) arising from prototype pollution behavior in JavaScript. The header parser in node_modules/haraka-email-message/lib/header.js stores parsed email headers in a plain {} object using the _add_header(key, value, method) function. When the header key is __proto__, accessing this.headers['__proto__'] returns Object.prototype (via the prototype getter) rather than null or undefined, so the nullish coalescing assignment (??=) is skipped. The subsequent call Object.prototype.push(value) throws a TypeError: not a function, which propagates to Haraka's global uncaughtException handler and triggers process.exit(1). No authentication or special privileges are required — any remote sender able to deliver an SMTP message to the server can trigger the crash (GitHub Advisory, Haraka Advisory).

Successful exploitation results in a complete availability loss of the Haraka mail service with no impact on confidentiality or integrity. In single-process mode (nodes=0), the entire server process terminates, taking the mail service fully offline. In cluster mode, the master process restarts the crashed worker, but all active SMTP sessions are lost, causing email delivery disruptions. Repeated exploitation can sustain a persistent denial of service condition (GitHub Advisory, Haraka Advisory).

A public proof-of-concept (PoC) exploit is available in the form of a Python script included directly in the GitHub Security Advisory. The exploit requires no authentication and can be executed by any remote attacker with network access to the SMTP port. The EPSS score is approximately 0.042% (0.026% per GitHub Advisory), indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Haraka Advisory).

1. Reconnaissance: Identify internet-facing Haraka SMTP servers (typically listening on port 25 or 2525) running versions ≤ 3.1.3 using tools like Shodan, Censys, or banner grabbing.
2. Establish SMTP connection: Open a TCP connection to the target Haraka server's SMTP port and receive the server greeting banner.
3. Conduct SMTP handshake: Send standard SMTP commands to initiate a mail transaction:
   • EHLO evil
   • MAIL FROM:<attacker@example.com>
   • RCPT TO:<victim@target.com>
   • DATA
4. Inject crash payload: After the server responds to DATA with a 354 prompt, send the malicious email body containing __proto__: as a header name:

   From: x@x.com\r\n__proto__: crash\r\n\r\nbody\r\n.\r\n

5. Trigger crash: The header parser processes __proto__ as a key, causing Object.prototype.push() to throw a TypeError, which reaches the global uncaughtException handler and calls process.exit(1), crashing the worker process.
6. Sustain DoS: Repeat the attack after each worker restart (in cluster mode) to maintain a persistent denial of service condition (GitHub Advisory, Haraka Advisory).

• Network: Inbound SMTP connections that initiate a full mail transaction (EHLO → MAIL FROM → RCPT TO → DATA) but deliver a message containing __proto__: in the email headers; repeated SMTP connections from the same source IP shortly after server restarts.
• Logs: Haraka critical log entries showing TypeError: not a function or stack traces originating from haraka-email-message/lib/header.js around lines 216–217; log entries from the uncaughtException handler followed by dump_and_exit(1); repeated worker process restart events in cluster mode logs.
• Process: Unexpected termination of the Haraka Node.js worker process (process.exit(1)); frequent worker respawn events recorded by the cluster master process.
• File System: Haraka crash dump files generated by logger.dump_and_exit(1) in the configured log or dump directory (GitHub Advisory, Haraka Advisory).

The primary remediation is to upgrade Haraka to version 3.1.4 or later, which contains the fix for this vulnerability (Haraka Release). For operators unable to patch immediately, a network-level workaround is to implement email filtering or SMTP proxy rules that detect and reject messages containing __proto__: as a header name before they reach the Haraka process. Additionally, running Haraka in cluster mode (with nodes > 0) reduces the impact by allowing automatic worker restarts, though it does not prevent the crash or session loss (GitHub Advisory).

The vulnerability was reported by researcher sebastianosrt and patched by Haraka maintainer msimerson, who published the advisory on March 30, 2026. The issue received brief coverage on social platforms including Mastodon and Bluesky, primarily through automated CVE notification accounts. Red Hat also acknowledged the CVE in their security tracking system. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been observed (Haraka Advisory).