{"id":"EUVD-2026-18509","enisaUuid":"923e44c0-c172-3035-975e-82c7fc21669c","description":"Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.","datePublished":"Apr 2, 2026, 6:42:38 PM","dateUpdated":"Apr 3, 2026, 3:47:34 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3\nhttps://github.com/haraka/Haraka/releases/tag/v3.1.4\n","aliases":"CVE-2026-34752\nGHSA-xph3-r2jf-4vp3\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"4d78de79-0e76-3db0-a686-30af407bd29f","product":{"name":"Haraka","vendor":{"name":"haraka"}},"product_version":"\u003c 3.1.4"}],"enisaIdVendor":[{"id":"78bc7fe7-02c1-340c-bac6-d1cc073aad08","vendor":{"name":"haraka"}}],"enisaIdVulnerability":[{"id":"71fba2a1-d7e3-36c5-8538-161cac03be39","vulnerability":{"id":"GHSA-xph3-r2jf-4vp3","description":"Haraka affected by DoS via `__proto__` email header","datePublished":"Apr 1, 2026, 10:56:09 PM","dateUpdated":"Apr 6, 2026, 5:32:41 PM","baseScore":0.0,"references":"https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34752\nhttps://github.com/haraka/Haraka\nhttps://github.com/haraka/Haraka/releases/tag/v3.1.4\n","enisa_id":"EUVD-2026-18509\n","aliases":"GHSA-xph3-r2jf-4vp3\nCVE-2026-34752\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:54:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aa126418-a9de-3222-b0ba-375c4962ac40","vulnerability":{"id":"CVE-2026-34752","description":"Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.","datePublished":"Apr 2, 2026, 6:42:38 PM","dateUpdated":"Apr 3, 2026, 3:47:34 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3\nhttps://github.com/haraka/Haraka/releases/tag/v3.1.4\n","enisa_id":"EUVD-2026-18509\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"c03d51de-9d1a-322a-b9a0-c489a3715357","product":{"name":"Haraka","vendor":{"name":"haraka"}},"product_version":"\u003c 3.1.4"}],"vulnerabilityVendor":[{"id":"7756e2d9-f37c-3d8e-8dc9-0cd674bfba38","vendor":{"name":"haraka"}}]}}],"enisaIdAdvisory":[]}