Haraka servers that receive an email with a header named __proto__ crash the worker process, leading to a denial of service. The flaw arises from improper handling of the header name during parsing. According to CWE-248, this is an off‑by‑one or similar error that causes the process to terminate, temporarily disabling the mail server until it is restarted. The impact is a loss of availability for all mail that the server receives until a restart occurs.

All installations of the Haraka mail server prior to version 3.1.4 are affected. The vendor is Haraka and the product is Haraka, running on Node.js. Any deployment that uses version 3.1.3 or earlier will be vulnerable.

An attacker can exploit the issue simply by sending an email containing a __proto__ header, a normal part of SMTP traffic. The CVSS score of 8.7 indicates high severity, and because no special privileges are needed the likelihood of exploitation is significant. The vulnerability is not currently listed in the KEV catalog, but the attack vector is remote over the network and would be easily triggered by any mail destined for the server.