Skip to main content
cve.nowby Sazabi
← npm
npmPackage

Haraka

2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
3.4.0 (Nov 5, 2026): no advisory affects it
Newest unaffected release
3.4.0 (Nov 5, 2026), the latest release
Advisories
2 · 1 high
Weekly downloads
40.3K
Dependents
0
Releases
122 since 0.5.0 (May 11, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Haraka affected by DoS via `proto` email header

    Affected: fixed in 3.1.4.

    Fixed in 3.1.4 (released Mar 30, 2026, 3 days before disclosure).

    The latest release, 3.4.0, is not affected.

    3.5% of Haraka downloads last week were affected versions (1.4K).

  • Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files.

    Affected: fixed in 2.8.9.

    Fixed in 2.8.9 (released Oct 3, 2016, 855 days before disclosure).

    The latest release, 3.4.0, is not affected.

    0.8% of Haraka downloads last week were affected versions (338).