TI-2026-25559 CVE-2026-33128 · GHSA-22cc-p3c6-wpvm
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Priority HIGH 76
H3 is a minimal H(TTP) framework.
h3js
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
h3js records in CISA KEVNo h3js vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records
TI-2026-25562 CVE-2026-33131 · GHSA-3vj8-jmxq-cgj5
h3 has a middleware bypass with one gadget
Priority HIGH 74
H3 is a minimal H(TTP) framework.
TI-2026-59038 CVE-2026-86252 · GHSA-jqj6-8hxr-7wwq
h3 before 1.15.9 SSE Event Injection via Carriage Return
Priority HIGH 70
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns.
TI-2026-59037 CVE-2026-86251 · GHSA-676v-2c25-vqpj
h3 before 1.15.9 Path Traversal via Double Decoding
Priority HIGH 69
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility.
TI-2026-25560 CVE-2026-33129 · GHSA-26f5-8h2x-34xh
h3 has an observable timing discrepancy in basic auth utils
Priority MEDIUM 60
H3 is a minimal H(TTP) framework.
TI-2026-58994 CVE-2026-86205 · GHSA-vhx4-2r84-67h4
h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
Priority MEDIUM 57
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname.
TI-2026-25886 CVE-2026-33490 · GHSA-2j6q-whv2-gh6w
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Priority MEDIUM 57
H3 is a minimal H(TTP) framework.
TI-2026-59036 CVE-2026-86250 · GHSA-q5pr-72pq-83v3
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
Priority MEDIUM 44
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions.
TI-2026-18951 CVE-2026-23527 · GHSA-mp2g-9vg9-f4cg
h3 v1 has Request Smuggling (TE.TE) issue
Priority MEDIUM 44
H3 is a minimal H(TTP) framework built for high performance and portability.
TI-2026-59039 CVE-2026-86253 · GHSA-jh84-7pcc-38gf
h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
Priority LOW 37
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic().
TI-2026-26111 CVE-2026-33732 · GHSA-p36q-q72m-gchr
srvx is vulnerable to middleware bypass via absolute URI in request line
Priority LOW 28
srvx is a universal server based on web standards.