Vulnerability-Lookup

CVE-2026-33490 (GCVE-0-2026-33490)

Vulnerability from cvelistv5 – Published: 2026-03-26 17:19 – Updated: 2026-03-26 18:23

Title

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Summary

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-26 17:46 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/h3js/h3/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
h3js	h3	Affected: >= 2.0.1-alpha.0, < 2.0.1-rc.17	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33490",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:46:14.997707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T18:23:39.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:19:15.956Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
        }
      ],
      "source": {
        "advisory": "GHSA-2j6q-whv2-gh6w",
        "discovery": "UNKNOWN"
      },
      "title": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33490",
    "datePublished": "2026-03-26T17:19:15.956Z",
    "dateReserved": "2026-03-20T16:16:48.971Z",
    "dateUpdated": "2026-03-26T18:23:39.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33490",
      "date": "2026-09-18",
      "epss": "0.00239",
      "percentile": "0.15263"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "h3",
                "vendor": "h3js",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "910077BC-C84C-4CAB-A0A5-761047F6F43C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*",
                    "matchCriteriaId": "603A08FC-B20B-4693-90A1-0BF5F08B43AC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*",
                    "matchCriteriaId": "BCC5ECF0-0EED-48BC-95FA-1D2671A971A9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*",
                    "matchCriteriaId": "BCCBE75E-DCF6-45FD-B57E-F8E2ADE3129F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*",
                    "matchCriteriaId": "3B66082C-3F3E-4BC6-9543-A2F9CFE3AAC6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*",
                    "matchCriteriaId": "3D1C9D7B-3CE4-427B-93B4-EAF867159AFB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc15:*:*:*:node.js:*:*",
                    "matchCriteriaId": "5AE7D8A6-4506-418A-ABA4-C820A1DA7E7F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc16:*:*:*:node.js:*:*",
                    "matchCriteriaId": "281715D9-6C86-4D4E-9833-C18A8CABD05A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C5E7779A-00CA-45E7-8F68-1DAB5388ED4A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*",
                    "matchCriteriaId": "064C21F5-8633-45F3-9A3D-3FB029A867B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*",
                    "matchCriteriaId": "DDBC1DFD-8063-4AE1-92D8-B3B33735FEF0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*",
                    "matchCriteriaId": "496314A3-8F2B-4274-9D0D-7F11E896FEA5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*",
                    "matchCriteriaId": "35F49342-D52C-4762-9369-F380C5E7E0B5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*",
                    "matchCriteriaId": "D11CA1A7-3141-46EA-9687-32C333FC7B0C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*",
                    "matchCriteriaId": "A4A6FD03-5DE5-4D73-9FF3-BB653302C60B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*",
                    "matchCriteriaId": "5E404148-6862-44F5-961D-10E8A742A4B6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
          },
          {
            "lang": "es",
            "value": "H3 es un framework H(TTP) m\u00ednimo. En las versiones 2.0.0-0 hasta la 2.0.1-rc.16, el m\u00e9todo \u0027mount()\u0027 en h3 usa una simple verificaci\u00f3n \u0027startsWith()\u0027 para determinar si las solicitudes entrantes caen bajo el prefijo de ruta de una subaplicaci\u00f3n montada. Debido a que esta verificaci\u00f3n no verifica un l\u00edmite de segmento de ruta (es decir, que el siguiente car\u00e1cter despu\u00e9s de la base es \u0027/\u0027 o el final de la cadena), el middleware registrado en un montaje como \u0027/admin\u0027 tambi\u00e9n se ejecutar\u00e1 para rutas no relacionadas como \u0027/admin-public\u0027, \u0027/administrator\u0027 o \u0027/adminstuff\u0027. Esto permite a un atacante activar middleware de configuraci\u00f3n de contexto en rutas que nunca se pretendi\u00f3 cubrir, potencialmente contaminando el contexto de la solicitud con indicadores de privilegio no deseados. La versi\u00f3n 2.0.2-rc.17 contiene un parche."
          }
        ],
        "id": "CVE-2026-33490",
        "lastModified": "2026-06-17T10:37:35.357",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33490",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:46:14.997707Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-26T18:16:30.237",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-706"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T10:59:35+00:00",
      "cve": "CVE-2026-33490",
      "id": "CVE-2026-33490",
      "initial_release_date": "2026-03-26T17:19:15.956000+00:00",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "h3: H3: Information disclosure due to incorrect path prefix validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33490.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33490",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-26T17:46:14.997707Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-26T17:46:23.495Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "h3",
              "vendor": "h3js",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-706",
                  "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-26T17:19:15.956Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
            }
          ],
          "source": {
            "advisory": "GHSA-2j6q-whv2-gh6w",
            "discovery": "UNKNOWN"
          },
          "title": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-33490",
        "datePublished": "2026-03-26T17:19:15.956Z",
        "dateReserved": "2026-03-20T16:16:48.971Z",
        "dateUpdated": "2026-03-26T18:23:39.653Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33490

Vulnerability from fkie_nvd - Published: 2026-03-26 18:16 - Updated: 2026-06-17 10:37

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w	Exploit, Mitigation, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w	Exploit, Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1
h3	h3	2.0.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1-alpha.0, \u003c 2.0.1-rc.17"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*",
              "matchCriteriaId": "910077BC-C84C-4CAB-A0A5-761047F6F43C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*",
              "matchCriteriaId": "603A08FC-B20B-4693-90A1-0BF5F08B43AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*",
              "matchCriteriaId": "BCC5ECF0-0EED-48BC-95FA-1D2671A971A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*",
              "matchCriteriaId": "BCCBE75E-DCF6-45FD-B57E-F8E2ADE3129F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*",
              "matchCriteriaId": "3B66082C-3F3E-4BC6-9543-A2F9CFE3AAC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*",
              "matchCriteriaId": "3D1C9D7B-3CE4-427B-93B4-EAF867159AFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc15:*:*:*:node.js:*:*",
              "matchCriteriaId": "5AE7D8A6-4506-418A-ABA4-C820A1DA7E7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc16:*:*:*:node.js:*:*",
              "matchCriteriaId": "281715D9-6C86-4D4E-9833-C18A8CABD05A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*",
              "matchCriteriaId": "C5E7779A-00CA-45E7-8F68-1DAB5388ED4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*",
              "matchCriteriaId": "064C21F5-8633-45F3-9A3D-3FB029A867B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*",
              "matchCriteriaId": "DDBC1DFD-8063-4AE1-92D8-B3B33735FEF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*",
              "matchCriteriaId": "496314A3-8F2B-4274-9D0D-7F11E896FEA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*",
              "matchCriteriaId": "35F49342-D52C-4762-9369-F380C5E7E0B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*",
              "matchCriteriaId": "D11CA1A7-3141-46EA-9687-32C333FC7B0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*",
              "matchCriteriaId": "A4A6FD03-5DE5-4D73-9FF3-BB653302C60B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*",
              "matchCriteriaId": "5E404148-6862-44F5-961D-10E8A742A4B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
    },
    {
      "lang": "es",
      "value": "H3 es un framework H(TTP) m\u00ednimo. En las versiones 2.0.0-0 hasta la 2.0.1-rc.16, el m\u00e9todo \u0027mount()\u0027 en h3 usa una simple verificaci\u00f3n \u0027startsWith()\u0027 para determinar si las solicitudes entrantes caen bajo el prefijo de ruta de una subaplicaci\u00f3n montada. Debido a que esta verificaci\u00f3n no verifica un l\u00edmite de segmento de ruta (es decir, que el siguiente car\u00e1cter despu\u00e9s de la base es \u0027/\u0027 o el final de la cadena), el middleware registrado en un montaje como \u0027/admin\u0027 tambi\u00e9n se ejecutar\u00e1 para rutas no relacionadas como \u0027/admin-public\u0027, \u0027/administrator\u0027 o \u0027/adminstuff\u0027. Esto permite a un atacante activar middleware de configuraci\u00f3n de contexto en rutas que nunca se pretendi\u00f3 cubrir, potencialmente contaminando el contexto de la solicitud con indicadores de privilegio no deseados. La versi\u00f3n 2.0.2-rc.17 contiene un parche."
    }
  ],
  "id": "CVE-2026-33490",
  "lastModified": "2026-06-17T10:37:35.357",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33490",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-26T17:46:14.997707Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-26T18:16:30.237",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-706"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2J6Q-WHV2-GH6W

Vulnerability from github – Published: 2026-03-20 20:50 – Updated: 2026-03-27 20:58

Summary

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Details

Summary

The mount() method in h3 uses a simple startsWith() check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is / or end-of-string), middleware registered on a mount like /admin will also execute for unrelated routes such as /admin-public, /administrator, or /adminstuff. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.

Details

The root cause is in src/h3.ts:127 within the mount() method:

// src/h3.ts:122-135
mount(base: string, input: FetchHandler | FetchableObject | H3Type) {
  if ("handler" in input) {
    if (input["~middleware"].length > 0) {
      this["~middleware"].push((event, next) => {
        const originalPathname = event.url.pathname;
        if (!originalPathname.startsWith(base)) {  // <-- BUG: no segment boundary check
          return next();
        }
        event.url.pathname = event.url.pathname.slice(base.length) || "/";
        return callMiddleware(event, input["~middleware"], () => {
          event.url.pathname = originalPathname;
          return next();
        });
      });
    }

When a sub-app is mounted at /admin, the check originalPathname.startsWith("/admin") returns true for /admin, /admin/, /admin/dashboard, but also for /admin-public, /administrator, /adminFoo, etc. The mounted sub-app's entire middleware chain then executes for these unrelated paths.

A secondary instance of the same flaw exists in src/utils/internal/path.ts:40:

// src/utils/internal/path.ts:35-45
export function withoutBase(input: string = "", base: string = ""): string {
  if (!base || base === "/") {
    return input;
  }
  const _base = withoutTrailingSlash(base);
  if (!input.startsWith(_base)) {  // <-- Same flaw: no segment boundary check
    return input;
  }
  const trimmed = input.slice(_base.length);
  return trimmed[0] === "/" ? trimmed : "/" + trimmed;
}

The withoutBase() utility will incorrectly strip the base from paths that merely share a string prefix, returning mangled paths (e.g., withoutBase("/admin-public/info", "/admin") returns /-public/info).

Exploitation flow:

Developer mounts a sub-app at /admin with middleware that sets event.context.isAdmin = true
Developer defines a separate route /admin-public/info on the parent app that reads event.context.isAdmin
Attacker requests GET /admin-public/info
The /admin mount's startsWith check passes → admin middleware executes → sets isAdmin = true
The middleware's "restore pathname" callback fires, control returns to the parent app
The /admin-public/info handler sees event.context.isAdmin === true

PoC

// poc.js — demonstrates context pollution across mount boundaries
import { H3 } from "h3";

const adminApp = new H3();

// Admin middleware sets privileged context
adminApp.use(() => {}, {
  onRequest: (event) => {
    event.context.isAdmin = true;
  }
});

adminApp.get("/dashboard", (event) => {
  return { admin: true, context: event.context };
});

const app = new H3();

// Mount admin sub-app at /admin
app.mount("/admin", adminApp);

// Public route that happens to share the "/admin" prefix
app.get("/admin-public/info", (event) => {
  return {
    path: event.url.pathname,
    isAdmin: event.context.isAdmin ?? false,  // Should always be false here
  };
});

// Test with fetch
const server = Bun.serve({ port: 3000, fetch: app.fetch });

// This request should NOT trigger admin middleware, but it does
const res = await fetch("http://localhost:3000/admin-public/info");
const body = await res.json();
console.log(body);
// Actual output: { path: "/admin-public/info", isAdmin: true }
// Expected output: { path: "/admin-public/info", isAdmin: false }

server.stop();

Steps to reproduce:

# 1. Clone h3 and install
git clone https://github.com/h3js/h3 && cd h3
corepack enable && pnpm install && pnpm build

# 2. Save poc.js (above) and run
bun poc.js
# Output shows isAdmin: true — admin middleware leaked to /admin-public/info

# 3. Verify the boundary leak with additional paths:
# GET /administrator → admin middleware fires
# GET /adminstuff   → admin middleware fires
# GET /admin123     → admin middleware fires
# GET /admi         → admin middleware does NOT fire (correct)

Impact

Context pollution across mount boundaries: Middleware registered on a mounted sub-app executes for any route sharing the string prefix, not just routes under the intended path segment tree. This can set privileged flags (isAdmin, isAuthenticated, role assignments) on requests to completely unrelated routes.
Authorization bypass: If an application uses mount-scoped middleware to set permissive context flags and other routes check those flags, an attacker can access protected functionality by requesting a path that string-prefix-matches the mount base but routes to a different handler.
Path mangling: The withoutBase() utility produces incorrect paths (e.g., /-public/info instead of /admin-public/info) when the input shares only a string prefix, potentially causing routing errors or further security issues in downstream path processing.
Scope: Any h3 v2 application using mount() with a base path that is a string prefix of other routes is affected. The impact scales with how the application uses middleware-set context values.

Recommended Fix

Add a segment boundary check after the startsWith call in both locations. The character immediately following the base prefix must be /, ?, #, or the string must end exactly at the base:

Fix for src/h3.ts:127:

 mount(base: string, input: FetchHandler | FetchableObject | H3Type) {
   if ("handler" in input) {
     if (input["~middleware"].length > 0) {
       this["~middleware"].push((event, next) => {
         const originalPathname = event.url.pathname;
-        if (!originalPathname.startsWith(base)) {
+        if (!originalPathname.startsWith(base) ||
+            (originalPathname.length > base.length && originalPathname[base.length] !== "/")) {
           return next();
         }

Fix for src/utils/internal/path.ts:40:

 export function withoutBase(input: string = "", base: string = ""): string {
   if (!base || base === "/") {
     return input;
   }
   const _base = withoutTrailingSlash(base);
-  if (!input.startsWith(_base)) {
+  if (!input.startsWith(_base) ||
+      (input.length > _base.length && input[_base.length] !== "/")) {
     return input;
   }

This ensures that /admin only matches /admin, /admin/, and /admin/... — never /admin-public, /administrator, or other coincidental string-prefix matches.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.1-rc.16"
      },
      "package": {
        "ecosystem": "npm",
        "name": "h3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1-alpha.0"
            },
            {
              "fixed": "2.0.1-rc.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:50:27Z",
    "nvd_published_at": "2026-03-26T18:16:30Z",
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.\n\n## Details\n\nThe root cause is in `src/h3.ts:127` within the `mount()` method:\n\n```typescript\n// src/h3.ts:122-135\nmount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n  if (\"handler\" in input) {\n    if (input[\"~middleware\"].length \u003e 0) {\n      this[\"~middleware\"].push((event, next) =\u003e {\n        const originalPathname = event.url.pathname;\n        if (!originalPathname.startsWith(base)) {  // \u003c-- BUG: no segment boundary check\n          return next();\n        }\n        event.url.pathname = event.url.pathname.slice(base.length) || \"/\";\n        return callMiddleware(event, input[\"~middleware\"], () =\u003e {\n          event.url.pathname = originalPathname;\n          return next();\n        });\n      });\n    }\n```\n\nWhen a sub-app is mounted at `/admin`, the check `originalPathname.startsWith(\"/admin\")` returns `true` for `/admin`, `/admin/`, `/admin/dashboard`, but also for `/admin-public`, `/administrator`, `/adminFoo`, etc. The mounted sub-app\u0027s entire middleware chain then executes for these unrelated paths.\n\nA secondary instance of the same flaw exists in `src/utils/internal/path.ts:40`:\n\n```typescript\n// src/utils/internal/path.ts:35-45\nexport function withoutBase(input: string = \"\", base: string = \"\"): string {\n  if (!base || base === \"/\") {\n    return input;\n  }\n  const _base = withoutTrailingSlash(base);\n  if (!input.startsWith(_base)) {  // \u003c-- Same flaw: no segment boundary check\n    return input;\n  }\n  const trimmed = input.slice(_base.length);\n  return trimmed[0] === \"/\" ? trimmed : \"/\" + trimmed;\n}\n```\n\nThe `withoutBase()` utility will incorrectly strip the base from paths that merely share a string prefix, returning mangled paths (e.g., `withoutBase(\"/admin-public/info\", \"/admin\")` returns `/-public/info`).\n\n**Exploitation flow:**\n\n1. Developer mounts a sub-app at `/admin` with middleware that sets `event.context.isAdmin = true`\n2. Developer defines a separate route `/admin-public/info` on the parent app that reads `event.context.isAdmin`\n3. Attacker requests `GET /admin-public/info`\n4. The `/admin` mount\u0027s `startsWith` check passes \u2192 admin middleware executes \u2192 sets `isAdmin = true`\n5. The middleware\u0027s \"restore pathname\" callback fires, control returns to the parent app\n6. The `/admin-public/info` handler sees `event.context.isAdmin === true`\n\n## PoC\n\n```javascript\n// poc.js \u2014 demonstrates context pollution across mount boundaries\nimport { H3 } from \"h3\";\n\nconst adminApp = new H3();\n\n// Admin middleware sets privileged context\nadminApp.use(() =\u003e {}, {\n  onRequest: (event) =\u003e {\n    event.context.isAdmin = true;\n  }\n});\n\nadminApp.get(\"/dashboard\", (event) =\u003e {\n  return { admin: true, context: event.context };\n});\n\nconst app = new H3();\n\n// Mount admin sub-app at /admin\napp.mount(\"/admin\", adminApp);\n\n// Public route that happens to share the \"/admin\" prefix\napp.get(\"/admin-public/info\", (event) =\u003e {\n  return {\n    path: event.url.pathname,\n    isAdmin: event.context.isAdmin ?? false,  // Should always be false here\n  };\n});\n\n// Test with fetch\nconst server = Bun.serve({ port: 3000, fetch: app.fetch });\n\n// This request should NOT trigger admin middleware, but it does\nconst res = await fetch(\"http://localhost:3000/admin-public/info\");\nconst body = await res.json();\nconsole.log(body);\n// Actual output: { path: \"/admin-public/info\", isAdmin: true }\n// Expected output: { path: \"/admin-public/info\", isAdmin: false }\n\nserver.stop();\n```\n\n**Steps to reproduce:**\n\n```bash\n# 1. Clone h3 and install\ngit clone https://github.com/h3js/h3 \u0026\u0026 cd h3\ncorepack enable \u0026\u0026 pnpm install \u0026\u0026 pnpm build\n\n# 2. Save poc.js (above) and run\nbun poc.js\n# Output shows isAdmin: true \u2014 admin middleware leaked to /admin-public/info\n\n# 3. Verify the boundary leak with additional paths:\n# GET /administrator \u2192 admin middleware fires\n# GET /adminstuff   \u2192 admin middleware fires\n# GET /admin123     \u2192 admin middleware fires\n# GET /admi         \u2192 admin middleware does NOT fire (correct)\n```\n\n## Impact\n\n- **Context pollution across mount boundaries**: Middleware registered on a mounted sub-app executes for any route sharing the string prefix, not just routes under the intended path segment tree. This can set privileged flags (`isAdmin`, `isAuthenticated`, role assignments) on requests to completely unrelated routes.\n- **Authorization bypass**: If an application uses mount-scoped middleware to set permissive context flags and other routes check those flags, an attacker can access protected functionality by requesting a path that string-prefix-matches the mount base but routes to a different handler.\n- **Path mangling**: The `withoutBase()` utility produces incorrect paths (e.g., `/-public/info` instead of `/admin-public/info`) when the input shares only a string prefix, potentially causing routing errors or further security issues in downstream path processing.\n- **Scope**: Any h3 v2 application using `mount()` with a base path that is a string prefix of other routes is affected. The impact scales with how the application uses middleware-set context values.\n\n## Recommended Fix\n\nAdd a segment boundary check after the `startsWith` call in both locations. The character immediately following the base prefix must be `/`, `?`, `#`, or the string must end exactly at the base:\n\n**Fix for `src/h3.ts:127`:**\n\n```diff\n mount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n   if (\"handler\" in input) {\n     if (input[\"~middleware\"].length \u003e 0) {\n       this[\"~middleware\"].push((event, next) =\u003e {\n         const originalPathname = event.url.pathname;\n-        if (!originalPathname.startsWith(base)) {\n+        if (!originalPathname.startsWith(base) ||\n+            (originalPathname.length \u003e base.length \u0026\u0026 originalPathname[base.length] !== \"/\")) {\n           return next();\n         }\n```\n\n**Fix for `src/utils/internal/path.ts:40`:**\n\n```diff\n export function withoutBase(input: string = \"\", base: string = \"\"): string {\n   if (!base || base === \"/\") {\n     return input;\n   }\n   const _base = withoutTrailingSlash(base);\n-  if (!input.startsWith(_base)) {\n+  if (!input.startsWith(_base) ||\n+      (input.length \u003e _base.length \u0026\u0026 input[_base.length] !== \"/\")) {\n     return input;\n   }\n```\n\nThis ensures that `/admin` only matches `/admin`, `/admin/`, and `/admin/...` \u2014 never `/admin-public`, `/administrator`, or other coincidental string-prefix matches.",
  "id": "GHSA-2j6q-whv2-gh6w",
  "modified": "2026-03-27T20:58:29Z",
  "published": "2026-03-20T20:50:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33490"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/h3js/h3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33490 (GCVE-0-2026-33490)

FKIE_CVE-2026-33490

GHSA-2J6Q-WHV2-GH6W

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Related by attack behaviour