Firework damage currently ignores friendly fire, allowing you to kill others on servers even in peaceful zones. Even if you can't physically place blocks like lava.
To test it do:
/scoreboard teams add Temp
/scoreboard teams option Temp friendlyfire false
/scoreboard teams join Temp @a
/give @p minecraft:fireworks 1 0 {Fireworks:{Explosions:[{}]}}
Make sure other player has a block over them, and summon fireworks on them.
I have not tested it with the server property settings, though I imagine that would result in the same thing.
Is this still an issue in the most recent versions (currently that is 1.13, or the latest snapshot 18w31a) of Minecraft? If so, please update the affected versions and help us keeping this ticket updated from time to time. If you are the owner/reporter of this ticket, you can modify the affected version(s) yourself.