← Back

Haraka Project

haraka_project

2 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Haraka
haraka
2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-34752
1Haraka Project
1Haraka
Jul 24, 2026
Apr 2, 2026
8.7 HIGH· v4
7.5 HIGH· v3
N/A· v2
Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4.
CVE-2016-1000282
1Haraka Project
1Haraka
Nov 21, 2024
Feb 5, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.