Read the docs
TI-2026-25562 Aliases CVE-2026-33131GHSA-3vj8-jmxq-cgj5

h3 has a middleware bypass with one gadget

Priority HIGH 74CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed h3 (h3js): 2.0.1-rc.15h3 (npm): 2.0.1-rc.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
h3jsh32.0.0-0 to before 2.0.1-rc.152.0.1-rc.15Patch availableCNA
—h3 (npm)2.0.0-0 to before 2.0.1-rc.152.0.1-rc.15Patch availableGHSA-3vj8-jmxq-cgj5
  • h3 Vendorh3js Affected 2.0.0-0 to before 2.0.1-rc.15 Fixed in 2.0.1-rc.15 Patch available CNA
  • h3 (npm) Vendor— Affected 2.0.0-0 to before 2.0.1-rc.15 Fixed in 2.0.1-rc.15 Patch available GHSA-3vj8-jmxq-cgj5

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*2.0.0Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*2.0.1 rc10Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*2.0.1 rc11Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*2.0.1 rc12Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*2.0.1 rc13Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*2.0.1 rc14Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*2.0.1 rc2Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*2.0.1 rc3Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*2.0.1 rc4Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*2.0.1 rc5Vulnerableh3js
  • cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:* Versions 2.0.0 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:* Versions 2.0.1 rc10 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:* Versions 2.0.1 rc11 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:* Versions 2.0.1 rc12 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:* Versions 2.0.1 rc13 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:* Versions 2.0.1 rc14 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:* Versions 2.0.1 rc2 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:* Versions 2.0.1 rc3 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:* Versions 2.0.1 rc4 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:* Versions 2.0.1 rc5 Vulnerable ·h3js
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*2.0.1 rc6Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*2.0.1 rc7Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*2.0.1 rc8Vulnerableh3js
cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*2.0.1 rc9Vulnerableh3js
  • cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:* Versions 2.0.1 rc6 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:* Versions 2.0.1 rc7 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:* Versions 2.0.1 rc8 Vulnerable ·h3js
  • cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:* Versions 2.0.1 rc9 Vulnerable ·h3js

Remediation

  • Fix · CNA h3 (h3js) Fixed in 2.0.1-rc.15
  • Fix · GHSA-3vj8-jmxq-cgj5 h3 (npm) Fixed in 2.0.1-rc.15 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33131
  2. 2026-10-03 Alias added: GHSA-3vj8-jmxq-cgj5

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-25559 h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields CVSS 3.1CRITICAL 10.0
  • TI-2026-25560 h3 has an observable timing discrepancy in basic auth utils CVSS 3.1MEDIUM 5.9
  • TI-2026-25886 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes CVSS 3.1MEDIUM 5.3
  • TI-2026-18951 h3 v1 has Request Smuggling (TE.TE) issue CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences