Haraka

Communication & Email

A highly scalable Node.js SMTP server with a modular plugin architecture for handling thousands of concurrent connections and delivering mail.

JavaScript Latest v3.3.2 · 6d ago Security brief →

Features

Modular plugin system exposing hooks like connect, helo, mail, rcpt, data, etc.
Built‑in strong spam protection via community plugins (DNSBLs, DKIM, SpamAssassin, rspamd).
Scalable outbound delivery engine that automatically queues relaying messages.

View all 10 releases →

Review required

v3.3.2 Security relevant 6d

Dependencies

Dependency security bump

Open

Review required

v3.3.1 Breaking risk 1mo

Auth Dependencies

@email-address removal + postel option + fetch exposure

Open

Review required

v3.2.0 Breaking risk 2mo

Dependencies Breaking upgrade

address-rfc282 replacement

Open

Review required

v3.1.6 Breaking risk 2mo

Dependencies Auth

Dependency removals

Open

v3.1.5 Bug fix 3mo

Fixed SMTP forward queue hook to call next() after delivery.

Full changelog

fix(smtp_forward): update AUTH to match WHATWG URL API #3546
fix(smtp_forward): queue hook now calls next() after delivery
— see haraka/message-stream#17
deps(all): bump versions to latest
test: refactor server, use smtp_client for all tests #3548
test runner is now node --test #3547
test(smtp_client, tls_socket, smtp_forward): 95% coverage #3546
ci: added explicit minimal permissions

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.