Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-86253 (GCVE-0-2026-86253)

Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-10 15:04

Title

h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

Summary

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:19 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.6 (semver) Unaffected: 1.15.6 (semver) Affected: 2.0.0-beta.0 , < 2.0.1-rc.15 (semver) Unaffected: 2.0.1-rc.15 (semver)

Date Public

2026-03-17 00:00

Credits

0xkakash1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86253",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:19:05.242837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:04:40.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.6",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1-rc.15",
              "status": "affected",
              "version": "2.0.0-beta.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.15",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0xkakash1"
        }
      ],
      "datePublic": "2026-03-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 (npm package) versions \u003c= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:28.232Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wr4h-v87w-p3r7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments"
        }
      ],
      "title": "h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86253",
    "datePublished": "2026-09-06T12:00:28.232Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-10T15:04:40.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86252 (GCVE-0-2026-86252)

Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-08 15:13

Title

h3 before 1.15.9 SSE Event Injection via Carriage Return

Summary

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:11 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.9 (semver) Unaffected: 1.15.9 (semver) Affected: 2.0.0-beta.0 , < 2.0.1-rc.17 (semver) Unaffected: 2.0.1-rc.17 (semver)

Date Public

2026-03-20 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86252",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:11:57.605320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:13:40.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.9",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1-rc.17",
              "status": "affected",
              "version": "2.0.0-beta.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.17",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:27.561Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4hxc-9384-m385)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.9 SSE Event Injection via Carriage Return",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return"
        }
      ],
      "title": "h3 before 1.15.9 SSE Event Injection via Carriage Return",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86252",
    "datePublished": "2026-09-06T12:00:27.561Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-08T15:13:40.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86251 (GCVE-0-2026-86251)

Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-09 13:57

Title

h3 before 1.15.9 Path Traversal via Double Decoding

Summary

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 13:57 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.9 (semver) Unaffected: 1.15.9 (semver)

Date Public

2026-03-20 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86251",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:57:13.508362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:57:41.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal \u0027.\u0027 characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as \u0027..\u0027 per RFC 3986, enabling path traversal to read arbitrary files from the backend."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:26.881Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-72gr-qfp7-vwhw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.9 Path Traversal via Double Decoding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-path-traversal-via-double-decoding"
        }
      ],
      "title": "h3 before 1.15.9 Path Traversal via Double Decoding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86251",
    "datePublished": "2026-09-06T12:00:26.881Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-09T13:57:41.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86250 (GCVE-0-2026-86250)

Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-18 17:23

Title

h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

Summary

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 17:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-2.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 2.0.0-beta.4 , < 2.0.1-rc.18 (semver) Unaffected: 2.0.1-rc.18 (semver)

Date Public

2026-03-21 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:07:52.002310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:10.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "2.0.1-rc.18",
              "status": "affected",
              "version": "2.0.0-beta.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.18",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:26.211Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q5pr-72pq-83v3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3"
        },
        {
          "name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie"
        }
      ],
      "title": "h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86250",
    "datePublished": "2026-09-06T12:00:26.211Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-18T17:23:10.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86205 (GCVE-0-2026-86205)

Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-08 13:28

Title

h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

Summary

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 13:28 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-2.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 2.0.1-rc.17 , < 2.0.1-rc.18 (semver) Unaffected: 2.0.1-rc.18 (semver)

Date Public

2026-03-21 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86205",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T13:28:03.688110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T13:28:55.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "2.0.1-rc.18",
              "status": "affected",
              "version": "2.0.1-rc.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.18",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:25.530Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fp4x-ggrf-wmc6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6"
        },
        {
          "name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Open Redirect via redirectBack()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-open-redirect-via-redirectback"
        }
      ],
      "title": "h3 before 2.0.1-rc.18 Open Redirect via redirectBack()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86205",
    "datePublished": "2026-09-06T12:00:25.530Z",
    "dateReserved": "2026-09-05T11:52:36.822Z",
    "dateUpdated": "2026-09-08T13:28:55.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33732 (GCVE-0-2026-33732)

Vulnerability from nvd – Published: 2026-03-26 17:21 – Updated: 2026-03-27 14:41

Title

srvx is vulnerable to middleware bypass via absolute URI in request line

Summary

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-27 14:41 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/srvx/commit/de0d69901c357…	x_refsource_MISC
https://github.com/h3js/srvx/releases/tag/v0.11.13	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	srvx	Affected: < 0.11.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T14:41:02.997076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T14:41:11.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "srvx",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx\u0027s `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:21:15.709Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr"
        },
        {
          "name": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa"
        },
        {
          "name": "https://github.com/h3js/srvx/releases/tag/v0.11.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/srvx/releases/tag/v0.11.13"
        }
      ],
      "source": {
        "advisory": "GHSA-p36q-q72m-gchr",
        "discovery": "UNKNOWN"
      },
      "title": "srvx is vulnerable to middleware bypass via absolute URI in request line"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33732",
    "datePublished": "2026-03-26T17:21:15.709Z",
    "dateReserved": "2026-03-23T17:34:57.560Z",
    "dateUpdated": "2026-03-27T14:41:11.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33490 (GCVE-0-2026-33490)

Vulnerability from nvd – Published: 2026-03-26 17:19 – Updated: 2026-03-26 18:23

Title

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Summary

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-26 17:46 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.1-alpha.0, < 2.0.1-rc.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33490",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:46:14.997707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T18:23:39.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:19:15.956Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
        }
      ],
      "source": {
        "advisory": "GHSA-2j6q-whv2-gh6w",
        "discovery": "UNKNOWN"
      },
      "title": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33490",
    "datePublished": "2026-03-26T17:19:15.956Z",
    "dateReserved": "2026-03-20T16:16:48.971Z",
    "dateUpdated": "2026-03-26T18:23:39.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33131 (GCVE-0-2026-33131)

Vulnerability from nvd – Published: 2026-03-20 10:16 – Updated: 2026-03-20 11:25

Title

h3 has a middleware bypass with one gadget

Summary

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 11:25 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.0-0, < 2.0.1-rc.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33131",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T11:25:14.200826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T11:25:53.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-0, \u003c 2.0.1-rc.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3\u0027s router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T10:16:29.556Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5"
        }
      ],
      "source": {
        "advisory": "GHSA-3vj8-jmxq-cgj5",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has a middleware bypass with one gadget"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33131",
    "datePublished": "2026-03-20T10:16:29.556Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T11:25:53.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33129 (GCVE-0-2026-33129)

Vulnerability from nvd – Published: 2026-03-20 09:41 – Updated: 2026-03-20 19:33

Title

h3 has an observable timing discrepancy in basic auth utils

Summary

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 19:33 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/pull/1283	x_refsource_MISC
https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.1-beta.0, < 2.0.1-rc.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33129",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T19:33:14.795855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T19:33:49.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-beta.0, \u003c 2.0.1-rc.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server\u0027s response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T09:41:21.933Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh"
        },
        {
          "name": "https://github.com/h3js/h3/pull/1283",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/pull/1283"
        },
        {
          "name": "https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9"
        }
      ],
      "source": {
        "advisory": "GHSA-26f5-8h2x-34xh",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has an observable timing discrepancy in basic auth utils"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33129",
    "datePublished": "2026-03-20T09:41:21.933Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T19:33:49.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33128 (GCVE-0-2026-33128)

Vulnerability from nvd – Published: 2026-03-20 09:37 – Updated: 2026-03-20 11:40

Title

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Summary

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 11:36 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/commit/7791538e15ca224…	x_refsource_MISC
https://github.com/h3js/h3/blob/52c82e18bb643d124…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.0, < 2.0.1-rc.15 Affected: < 1.15.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33128",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T11:36:13.079547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T11:40:27.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.1-rc.15"
            },
            {
              "status": "affected",
              "version": "\u003c 1.15.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T09:37:07.206Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm"
        },
        {
          "name": "https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6"
        },
        {
          "name": "https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187"
        }
      ],
      "source": {
        "advisory": "GHSA-22cc-p3c6-wpvm",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33128",
    "datePublished": "2026-03-20T09:37:07.206Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T11:40:27.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23527 (GCVE-0-2026-23527)

Vulnerability from nvd – Published: 2026-01-15 19:24 – Updated: 2026-04-13 16:48

Title

h3 v1 has Request Smuggling (TE.TE) issue

Summary

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.

Severity

8.9 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-15 19:59 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/commit/618ccf4f37b8b61…	x_refsource_MISC
https://github.com/h3js/h3/releases/tag/v1.15.5	x_refsource_MISC
https://simonkoeck.com/writeups/h3-transfer-encod…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: < 1.15.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T19:59:57.020909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T20:00:06.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for \"chunked\", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T16:48:19.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg"
        },
        {
          "name": "https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097"
        },
        {
          "name": "https://github.com/h3js/h3/releases/tag/v1.15.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/releases/tag/v1.15.5"
        },
        {
          "name": "https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling"
        }
      ],
      "source": {
        "advisory": "GHSA-mp2g-9vg9-f4cg",
        "discovery": "UNKNOWN"
      },
      "title": "h3 v1 has Request Smuggling (TE.TE) issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23527",
    "datePublished": "2026-01-15T19:24:20.514Z",
    "dateReserved": "2026-01-13T18:22:43.981Z",
    "dateUpdated": "2026-04-13T16:48:19.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86253 (GCVE-0-2026-86253)

Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-10 15:04

Title

h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

Summary

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:19 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.6 (semver) Unaffected: 1.15.6 (semver) Affected: 2.0.0-beta.0 , < 2.0.1-rc.15 (semver) Unaffected: 2.0.1-rc.15 (semver)

Date Public

2026-03-17 00:00

Credits

0xkakash1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86253",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:19:05.242837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:04:40.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.6",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1-rc.15",
              "status": "affected",
              "version": "2.0.0-beta.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.15",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0xkakash1"
        }
      ],
      "datePublic": "2026-03-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 (npm package) versions \u003c= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:28.232Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wr4h-v87w-p3r7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments"
        }
      ],
      "title": "h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86253",
    "datePublished": "2026-09-06T12:00:28.232Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-10T15:04:40.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86252 (GCVE-0-2026-86252)

Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-08 15:13

Title

h3 before 1.15.9 SSE Event Injection via Carriage Return

Summary

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 15:11 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.9 (semver) Unaffected: 1.15.9 (semver) Affected: 2.0.0-beta.0 , < 2.0.1-rc.17 (semver) Unaffected: 2.0.1-rc.17 (semver)

Date Public

2026-03-20 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86252",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:11:57.605320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:13:40.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.9",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1-rc.17",
              "status": "affected",
              "version": "2.0.0-beta.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.17",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:27.561Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4hxc-9384-m385)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.9 SSE Event Injection via Carriage Return",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return"
        }
      ],
      "title": "h3 before 1.15.9 SSE Event Injection via Carriage Return",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86252",
    "datePublished": "2026-09-06T12:00:27.561Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-08T15:13:40.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86251 (GCVE-0-2026-86251)

Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-09 13:57

Title

h3 before 1.15.9 Path Traversal via Double Decoding

Summary

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 13:57 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 0 , < 1.15.9 (semver) Unaffected: 1.15.9 (semver)

Date Public

2026-03-20 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86251",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T13:57:13.508362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T13:57:41.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "1.15.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.15.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal \u0027.\u0027 characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as \u0027..\u0027 per RFC 3986, enabling path traversal to read arbitrary files from the backend."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:26.881Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-72gr-qfp7-vwhw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw"
        },
        {
          "name": "VulnCheck Advisory: h3 before 1.15.9 Path Traversal via Double Decoding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-path-traversal-via-double-decoding"
        }
      ],
      "title": "h3 before 1.15.9 Path Traversal via Double Decoding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86251",
    "datePublished": "2026-09-06T12:00:26.881Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-09T13:57:41.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86250 (GCVE-0-2026-86250)

Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-18 17:23

Title

h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

Summary

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 17:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-2.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 2.0.0-beta.4 , < 2.0.1-rc.18 (semver) Unaffected: 2.0.1-rc.18 (semver)

Date Public

2026-03-21 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T17:07:52.002310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T17:23:10.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "2.0.1-rc.18",
              "status": "affected",
              "version": "2.0.0-beta.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.18",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:26.211Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q5pr-72pq-83v3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3"
        },
        {
          "name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie"
        }
      ],
      "title": "h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86250",
    "datePublished": "2026-09-06T12:00:26.211Z",
    "dateReserved": "2026-09-06T11:35:19.316Z",
    "dateUpdated": "2026-09-18T17:23:10.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86205 (GCVE-0-2026-86205)

Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-08 13:28

Title

h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

Summary

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 13:28 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	vendor-advisory
https://www.vulncheck.com/advisories/h3-before-2.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: 2.0.1-rc.17 , < 2.0.1-rc.18 (semver) Unaffected: 2.0.1-rc.18 (semver)

Date Public

2026-03-21 00:00

Credits

offset

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86205",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T13:28:03.688110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T13:28:55.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/h3",
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "lessThan": "2.0.1-rc.18",
              "status": "affected",
              "version": "2.0.1-rc.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.1-rc.18",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-06T12:00:25.530Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fp4x-ggrf-wmc6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6"
        },
        {
          "name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Open Redirect via redirectBack()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-open-redirect-via-redirectback"
        }
      ],
      "title": "h3 before 2.0.1-rc.18 Open Redirect via redirectBack()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86205",
    "datePublished": "2026-09-06T12:00:25.530Z",
    "dateReserved": "2026-09-05T11:52:36.822Z",
    "dateUpdated": "2026-09-08T13:28:55.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33732 (GCVE-0-2026-33732)

Vulnerability from cvelistv5 – Published: 2026-03-26 17:21 – Updated: 2026-03-27 14:41

Title

srvx is vulnerable to middleware bypass via absolute URI in request line

Summary

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-27 14:41 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/srvx/commit/de0d69901c357…	x_refsource_MISC
https://github.com/h3js/srvx/releases/tag/v0.11.13	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	srvx	Affected: < 0.11.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T14:41:02.997076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T14:41:11.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "srvx",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx\u0027s `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:21:15.709Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr"
        },
        {
          "name": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa"
        },
        {
          "name": "https://github.com/h3js/srvx/releases/tag/v0.11.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/srvx/releases/tag/v0.11.13"
        }
      ],
      "source": {
        "advisory": "GHSA-p36q-q72m-gchr",
        "discovery": "UNKNOWN"
      },
      "title": "srvx is vulnerable to middleware bypass via absolute URI in request line"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33732",
    "datePublished": "2026-03-26T17:21:15.709Z",
    "dateReserved": "2026-03-23T17:34:57.560Z",
    "dateUpdated": "2026-03-27T14:41:11.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33490 (GCVE-0-2026-33490)

Vulnerability from cvelistv5 – Published: 2026-03-26 17:19 – Updated: 2026-03-26 18:23

Title

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Summary

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-26 17:46 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.1-alpha.0, < 2.0.1-rc.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33490",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:46:14.997707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T18:23:39.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:19:15.956Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
        }
      ],
      "source": {
        "advisory": "GHSA-2j6q-whv2-gh6w",
        "discovery": "UNKNOWN"
      },
      "title": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33490",
    "datePublished": "2026-03-26T17:19:15.956Z",
    "dateReserved": "2026-03-20T16:16:48.971Z",
    "dateUpdated": "2026-03-26T18:23:39.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33131 (GCVE-0-2026-33131)

Vulnerability from cvelistv5 – Published: 2026-03-20 10:16 – Updated: 2026-03-20 11:25

Title

h3 has a middleware bypass with one gadget

Summary

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 11:25 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.0-0, < 2.0.1-rc.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33131",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T11:25:14.200826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T11:25:53.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-0, \u003c 2.0.1-rc.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3\u0027s router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T10:16:29.556Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5"
        }
      ],
      "source": {
        "advisory": "GHSA-3vj8-jmxq-cgj5",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has a middleware bypass with one gadget"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33131",
    "datePublished": "2026-03-20T10:16:29.556Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T11:25:53.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33129 (GCVE-0-2026-33129)

Vulnerability from cvelistv5 – Published: 2026-03-20 09:41 – Updated: 2026-03-20 19:33

Title

h3 has an observable timing discrepancy in basic auth utils

Summary

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 19:33 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/pull/1283	x_refsource_MISC
https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.1-beta.0, < 2.0.1-rc.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33129",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T19:33:14.795855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T19:33:49.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-beta.0, \u003c 2.0.1-rc.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server\u0027s response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T09:41:21.933Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh"
        },
        {
          "name": "https://github.com/h3js/h3/pull/1283",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/pull/1283"
        },
        {
          "name": "https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9"
        }
      ],
      "source": {
        "advisory": "GHSA-26f5-8h2x-34xh",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has an observable timing discrepancy in basic auth utils"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33129",
    "datePublished": "2026-03-20T09:41:21.933Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T19:33:49.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33128 (GCVE-0-2026-33128)

Vulnerability from cvelistv5 – Published: 2026-03-20 09:37 – Updated: 2026-03-20 11:40

Title

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Summary

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-20 11:36 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/commit/7791538e15ca224…	x_refsource_MISC
https://github.com/h3js/h3/blob/52c82e18bb643d124…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: >= 2.0.0, < 2.0.1-rc.15 Affected: < 1.15.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33128",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-20T11:36:13.079547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-20T11:40:27.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.1-rc.15"
            },
            {
              "status": "affected",
              "version": "\u003c 1.15.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T09:37:07.206Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm"
        },
        {
          "name": "https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6"
        },
        {
          "name": "https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187"
        }
      ],
      "source": {
        "advisory": "GHSA-22cc-p3c6-wpvm",
        "discovery": "UNKNOWN"
      },
      "title": "h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33128",
    "datePublished": "2026-03-20T09:37:07.206Z",
    "dateReserved": "2026-03-17T20:35:49.927Z",
    "dateUpdated": "2026-03-20T11:40:27.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23527 (GCVE-0-2026-23527)

Vulnerability from cvelistv5 – Published: 2026-01-15 19:24 – Updated: 2026-04-13 16:48

Title

h3 v1 has Request Smuggling (TE.TE) issue

Summary

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.

Severity

8.9 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-15 19:59 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/h3js/h3/commit/618ccf4f37b8b61…	x_refsource_MISC
https://github.com/h3js/h3/releases/tag/v1.15.5	x_refsource_MISC
https://simonkoeck.com/writeups/h3-transfer-encod…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
h3js	h3	Affected: < 1.15.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T19:59:57.020909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T20:00:06.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for \"chunked\", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T16:48:19.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg"
        },
        {
          "name": "https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097"
        },
        {
          "name": "https://github.com/h3js/h3/releases/tag/v1.15.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/h3js/h3/releases/tag/v1.15.5"
        },
        {
          "name": "https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling"
        }
      ],
      "source": {
        "advisory": "GHSA-mp2g-9vg9-f4cg",
        "discovery": "UNKNOWN"
      },
      "title": "h3 v1 has Request Smuggling (TE.TE) issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23527",
    "datePublished": "2026-01-15T19:24:20.514Z",
    "dateReserved": "2026-01-13T18:22:43.981Z",
    "dateUpdated": "2026-04-13T16:48:19.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by h3js

CVE-2026-86253 (GCVE-0-2026-86253)

CVE-2026-86252 (GCVE-0-2026-86252)

CVE-2026-86251 (GCVE-0-2026-86251)

CVE-2026-86250 (GCVE-0-2026-86250)

CVE-2026-86205 (GCVE-0-2026-86205)

CVE-2026-33732 (GCVE-0-2026-33732)

CVE-2026-33490 (GCVE-0-2026-33490)

CVE-2026-33131 (GCVE-0-2026-33131)

CVE-2026-33129 (GCVE-0-2026-33129)

CVE-2026-33128 (GCVE-0-2026-33128)

CVE-2026-23527 (GCVE-0-2026-23527)

CVE-2026-86253 (GCVE-0-2026-86253)

CVE-2026-86252 (GCVE-0-2026-86252)

CVE-2026-86251 (GCVE-0-2026-86251)

CVE-2026-86250 (GCVE-0-2026-86250)

CVE-2026-86205 (GCVE-0-2026-86205)

CVE-2026-33732 (GCVE-0-2026-33732)

CVE-2026-33490 (GCVE-0-2026-33490)

CVE-2026-33131 (GCVE-0-2026-33131)

CVE-2026-33129 (GCVE-0-2026-33129)

CVE-2026-33128 (GCVE-0-2026-33128)

CVE-2026-23527 (GCVE-0-2026-23527)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by h3js

CVE-2026-86253 (GCVE-0-2026-86253)

CVE-2026-86252 (GCVE-0-2026-86252)

CVE-2026-86251 (GCVE-0-2026-86251)

CVE-2026-86250 (GCVE-0-2026-86250)

CVE-2026-86205 (GCVE-0-2026-86205)

CVE-2026-33732 (GCVE-0-2026-33732)

CVE-2026-33490 (GCVE-0-2026-33490)

CVE-2026-33131 (GCVE-0-2026-33131)

CVE-2026-33129 (GCVE-0-2026-33129)

CVE-2026-33128 (GCVE-0-2026-33128)

CVE-2026-23527 (GCVE-0-2026-23527)

CVE-2026-86253 (GCVE-0-2026-86253)

CVE-2026-86252 (GCVE-0-2026-86252)

CVE-2026-86251 (GCVE-0-2026-86251)

CVE-2026-86250 (GCVE-0-2026-86250)

CVE-2026-86205 (GCVE-0-2026-86205)

CVE-2026-33732 (GCVE-0-2026-33732)

CVE-2026-33490 (GCVE-0-2026-33490)

CVE-2026-33131 (GCVE-0-2026-33131)

CVE-2026-33129 (GCVE-0-2026-33129)

CVE-2026-33128 (GCVE-0-2026-33128)

CVE-2026-23527 (GCVE-0-2026-23527)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.