Homepage
About Snyk

haraka@0.0.32 vulnerabilities

Inactive module name

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the haraka package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Remote Code Execution (RCE)

haraka is an email server with a modular plugin architecture.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). An attacker could pass a malicious zip file as an attachment to execute arbitrary code.

How to fix Remote Code Execution (RCE)?

Upgrade haraka to version 2.8.20 or higher.

<2.8.20
  • H
Denial of Service (DoS)

haraka is a scalable node.js email server with a modular plugin architecture

Affected versions of this package are vulnerable to Denial of Service (DoS) attacks via a crafted email containing a few million multiparts.

MIME (Multipurpose Internet Mail Extentions) is an internet standard that extends the format of email to support: Non-ACSII character sets, non-text attachments, and more.

Most Node.js MIME decoders do not validate the number of multiparts they are willing to decode, allowing an attacker to send a crafted email containing a few million multiparts, which will then block the Node.js event loop for tens of seconds, explode RAM usage, and cause an out of memory crash.

How to fix Denial of Service (DoS)?

Upgrade haraka to version 2.8.19 or higher.

<2.8.19
Go back to all versions of this package