Haraka, a Node.js mail server, crashes when an email containing a header named __proto__ is processed. This crash stops the worker process that handles incoming mail, causing the entire service to become unavailable for that worker. The vulnerability can be triggered by an attacker without any authentication, leading to a denial of service for users relying on the affected server.

The affected product is Haraka by the Haraka Project. Versions prior to 3.1.4 are vulnerable; any deployment running 3.1.3 or older is at risk. The issue is specific to the mail server component and does not directly affect other Node.js applications outside of Haraka.

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% shows a low likelihood of exploitation in the wild, which is reflected by the vulnerability not being listed in CISA’s KEV catalog. Despite the low exploitation probability, the attack vector is straightforward: an attacker can send a crafted email to the server over the network. No privileged access or additional conditions are required, making the vulnerability trivial to exploit for anyone able to reach the server.