CVE-2026-86250: Uncontrolled Resource Consumption

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

PT-2026-86519

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On² cleanup loop that hangs the server...

PT-2026-86520

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-86253: Improper Limitation of a Pathname to a Restricted Directory

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86205: URL Redirection to Untrusted Site

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

PT-2026-86521

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

PT-2026-86522

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

Malicious code in h3-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efe15c8b6a625f5ec662fc1d19f3191d0c9cd4a118565283dbe7ac9be1f54a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15584 Malicious code in h3-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efe15c8b6a625f5ec662fc1d19f3191d0c9cd4a118565283dbe7ac9be1f54a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-57063

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

EUVD-2026-31692

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body...

MAL-2026-2768 Malicious code in h3-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a779cef19955b279051dff59351c5f041b3834e2c9bd972c0b0be096aa767f The package h3-next was found to contain malicious code...

Malicious code in h3-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a779cef19955b279051dff59351c5f041b3834e2c9bd972c0b0be096aa767f The package h3-next was found to contain malicious code...

CVE-2026-33490

A flaw was found in H3, a minimal HTTP framework. The mount method, responsible for routing requests to sub-applications, incorrectly uses a simple string comparison to check path prefixes. This allows a remote attacker to craft a URL that bypasses the intended path segment boundary. Consequently...

CVE-2026-33490

H3 is a minimal HTTP framework. In versions 2.0.0-0 through 2.0.1-rc.16, the mount method in h3 uses a simple startsWith check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary i.e., that the next...

CVE-2026-33490 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

H3 is a minimal HTTP framework. In versions 2.0.0-0 through 2.0.1-rc.16, the mount method in h3 uses a simple startsWith check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary i.e., that the next...

CVE-2026-33490

Summary (CVE-2026-33490) : In h3 versions 2.0.0-0 through 2.0.1-rc.16, the mount() implementation uses a startsWith() path-prefix check without validating a segment boundary, allowing middleware registered on a mounted sub-app (e.g., at /admin) to run for unrelated routes such as /admin-public or...

CVE-2026-33490 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

H3 is a minimal HTTP framework. In versions 2.0.0-0 through 2.0.1-rc.16, the mount method in h3 uses a simple startsWith check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary i.e., that the next...

CVE-2026-33490 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

H3 is a minimal HTTP framework. In versions 2.0.0-0 through 2.0.1-rc.16, the mount method in h3 uses a simple startsWith check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary i.e., that the next...

H3 安全漏洞

H3 is an open-source HTTP framework developed by H3. Versions of H3 prior to 2.0.2-rc.17 contained security vulnerabilities. These vulnerabilities stemmed from the use of the startsWith method for checking paths, without verifying the boundaries of path segments. This could lead to middleware...