@abysslabs/cli (=0.0.2), @analogjs/vite-plugin-nitro (>=2.4.0-alpha.2 <=3.0.0-alpha.1) +54 more potentially affected by unknown CVE via h3 (>=2.0.0-beta.4 <=2.0.1-rc.16)

h3 NPM version =2.0.0-beta.4, =2.4.0-alpha.2, =0.0.0, =0.1.25, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.3.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15762218...

@abysslabs/cli (=0.0.2), @analogjs/vite-plugin-nitro (>=2.4.0-alpha.2 <=3.0.0-alpha.1) +54 more potentially affected by unknown CVE via h3 (>=2.0.0-beta.4 <=2.0.1-rc.16)

h3 NPM version =2.0.0-beta.4, =2.4.0-alpha.2, =0.0.0, =0.1.25, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.3.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q5PR-72PQ-83V3...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7343 more potentially affected by unknown CVE via h3 (>=0.2.12 <=1.15.6)

h3 NPM version =0.2.12, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4HXC-9384-M385...

@abysslabs/cli (=0.0.2), @analogjs/vite-plugin-nitro (>=2.4.0-alpha.2 <=3.0.0-alpha.1) +61 more potentially affected by unknown CVE via h3 (>=2.0.0-beta.0 <=2.0.1-rc.16)

h3 NPM version =2.0.0-beta.0, =2.4.0-alpha.2, =0.0.0, =0.1.25, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.5.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15746329...

@abysslabs/cli (=0.0.2), @analogjs/vite-plugin-nitro (>=2.4.0-alpha.2 <=3.0.0-alpha.1) +61 more potentially affected by unknown CVE via h3 (>=2.0.0-beta.0 <=2.0.1-rc.16)

h3 NPM version =2.0.0-beta.0, =2.4.0-alpha.2, =0.0.0, =0.1.25, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.5.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4HXC-9384-M385...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7269 more potentially affected by unknown CVE via h3 (>=1.0.1 <=1.15.6)

h3 NPM version =1.0.1, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15746329...

@abysslabs/cli (=0.0.2), @analogjs/vite-plugin-nitro (>=2.4.0-alpha.2 <=3.0.0-alpha.1) +26 more potentially affected by CVE-2026-33490 via h3 (>=2.0.1-rc.11 <=2.0.1-rc.16)

h3 NPM version =2.0.1-rc.11, =2.4.0-alpha.2, =3.23.1-20260131-121433-34f631e, =0.15.0, =1.154.7, =0.0.1, =1.154.7, =1.154.7, =1.154.7, =2.0.0-beta.17 and more Source cves: CVE-2026-33490 Source advisory: SNYK:JS-H3-15745916...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7269 more potentially affected by unknown CVE via h3 (>=1.0.1 <=1.15.6)

h3 NPM version =1.0.1, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15745711...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7269 more potentially affected by unknown CVE via h3 (>=1.0.1 <=1.15.5)

h3 NPM version =1.0.1, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15683856...

@abysslabs/cli (=0.0.2), @brendonovich/solidjs__start (>=0.0.0 <=0.0.3) +52 more potentially affected by unknown CVE via h3 (>=2.0.0-beta.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0-beta.0, =0.0.0, =0.1.25, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15683856...

@abysslabs/cli (=0.0.2), @eventodaigreja/ei-components (>=0.1.25 <=0.1.38) +21 more potentially affected by unknown CVE via h3 (>=2.0.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0, =0.1.25, =3.23.1-20260131-121433-34f631e, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =0.1.7, =0.3.1-beta.5, =0.0.1-beta.1, =0.0.1-beta.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WR4H-V87W-P3R7...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7343 more potentially affected by unknown CVE via h3 (>=0.2.12 <=1.15.5)

h3 NPM version =0.2.12, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WR4H-V87W-P3R7...

@abysslabs/cli (=0.0.2), @eventodaigreja/ei-components (>=0.1.25 <=0.1.38) +21 more potentially affected by CVE-2026-33131 via h3 (>=2.0.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0, =0.1.25, =3.23.1-20260131-121433-34f631e, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =0.1.7, =0.3.1-beta.5, =0.0.1-beta.1, =0.0.1-beta.7 and more Source cves: CVE-2026-33131 Source advisory: OSV:GHSA-3VJ8-JMXQ-CGJ5...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7269 more potentially affected by CVE-2026-33129 via h3 (>=1.0.1 <=1.15.6)

h3 NPM version =1.0.1, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: CVE-2026-33129 Source advisory: SNYK:JS-H3-15692482...

@100x/application (>=0.0.1 <=0.0.6), @abysslabs/cli (=0.0.2) +274 more potentially affected by CVE-2026-33129 via h3 (>=2.0.0-beta.0 <=2.0.1-rc.8)

h3 NPM version =2.0.0-beta.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.1.1, =0.6.1 and more Source cves: CVE-2026-33129 Source advisory: OSV:GHSA-26F5-8H2X-34XH...

@100x/application (>=0.0.1 <=0.0.6), @abysslabs/cli (=0.0.2) +274 more potentially affected by CVE-2026-33129 via h3 (>=2.0.0-beta.0 <=2.0.1-rc.8)

h3 NPM version =2.0.0-beta.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.1.1, =0.6.1 and more Source cves: CVE-2026-33129 Source advisory: SNYK:JS-H3-15692482...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7269 more potentially affected by CVE-2026-33128 via h3 (>=1.0.1 <=1.15.5)

h3 NPM version =1.0.1, =0.0.11, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: CVE-2026-33128 Source advisory: SNYK:JS-H3-15692480...

@abysslabs/cli (=0.0.2), @eventodaigreja/ei-components (>=0.1.25 <=0.1.38) +21 more potentially affected by CVE-2026-33128 via h3 (>=2.0.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0, =0.1.25, =3.23.1-20260131-121433-34f631e, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =0.1.7, =0.3.1-beta.5, =0.0.1-beta.1, =0.0.1-beta.7 and more Source cves: CVE-2026-33128 Source advisory: SNYK:JS-H3-15692480...

GHSA-MP2G-9VG9-F4CG h3 v1 has Request Smuggling (TE.TE) issue

I was digging into h3 v1 specifically v1.15.4 and found a critical HTTP Request Smuggling vulnerability. Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. The...