h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Priority HIGH 76CWE-93Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed h3 (h3js): 2.0.1-rc.15, 1.15.6h3 (npm): 2.0.1-rc.15, 1.15.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| h3js | h3 | 2.0.0 to before 2.0.1-rc.15; before 1.15.6 | 2.0.1-rc.15, 1.15.6 | Patch available | CNA |
| — | h3 (npm) | 2.0.0 to before 2.0.1-rc.15 | 2.0.1-rc.15 | Patch available | GHSA-22cc-p3c6-wpvm |
| — | h3 (npm) | before 1.15.6 | 1.15.6 | Patch available | GHSA-22cc-p3c6-wpvm |
- h3 Vendorh3js Affected 2.0.0 to before 2.0.1-rc.15; before 1.15.6 Fixed in 2.0.1-rc.15, 1.15.6 Patch available CNA
- h3 (npm) Vendor— Affected 2.0.0 to before 2.0.1-rc.15 Fixed in 2.0.1-rc.15 Patch available GHSA-22cc-p3c6-wpvm
- h3 (npm) Vendor— Affected before 1.15.6 Fixed in 1.15.6 Patch available GHSA-22cc-p3c6-wpvm
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:h3:h3:*:*:*:*:*:node.js:*:* | before 1.15.6 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:* | 2.0.0 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:* | 2.0.1 rc10 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:* | 2.0.1 rc11 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:* | 2.0.1 rc12 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:* | 2.0.1 rc13 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:* | 2.0.1 rc14 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:* | 2.0.1 rc2 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:* | 2.0.1 rc3 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:* | 2.0.1 rc4 | Vulnerable | h3js |
- cpe:2.3:a:h3:h3:*:*:*:*:*:node.js:*:* Versions before 1.15.6 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:* Versions 2.0.0 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:* Versions 2.0.1 rc10 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:* Versions 2.0.1 rc11 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:* Versions 2.0.1 rc12 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:* Versions 2.0.1 rc13 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:* Versions 2.0.1 rc14 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:* Versions 2.0.1 rc2 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:* Versions 2.0.1 rc3 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:* Versions 2.0.1 rc4 Vulnerable ·h3js
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:* | 2.0.1 rc5 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:* | 2.0.1 rc6 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:* | 2.0.1 rc7 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:* | 2.0.1 rc8 | Vulnerable | h3js |
| cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:* | 2.0.1 rc9 | Vulnerable | h3js |
- cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:* Versions 2.0.1 rc5 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:* Versions 2.0.1 rc6 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:* Versions 2.0.1 rc7 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:* Versions 2.0.1 rc8 Vulnerable ·h3js
- cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:* Versions 2.0.1 rc9 Vulnerable ·h3js
Remediation
- Fix · CNA h3 (h3js) Fixed in 2.0.1-rc.15, 1.15.6
- Fix · GHSA-22cc-p3c6-wpvm h3 (npm) Fixed in 2.0.1-rc.15 Advisory →
- Fix · GHSA-22cc-p3c6-wpvm h3 (npm) Fixed in 1.15.6 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33128
- 2026-10-03 Alias added: GHSA-22cc-p3c6-wpvm
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More h3js H3 vulnerabilities
- TI-2026-25562 h3 has a middleware bypass with one gadget CVSS 3.1CRITICAL 9.1
- TI-2026-25560 h3 has an observable timing discrepancy in basic auth utils CVSS 3.1MEDIUM 5.9
- TI-2026-25886 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes CVSS 3.1MEDIUM 5.3
- TI-2026-18951 h3 v1 has Request Smuggling (TE.TE) issue CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-33128 · CVE Program
- CVE-2026-33128 · NVD
- FIRST EPSS
- GHSA-22cc-p3c6-wpvm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33128 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences