0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7844 more potentially affected by CVE-2026-33128 via h3 (>=1.0.1 <=1.15.5)

h3 NPM version =1.0.1, =0.0.11, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: CVE-2026-33128 Source advisory: SNYK:JS-H3-15692480...

@abysslabs/cli (=0.0.2), @nuxt/test-utils (=4.0.0) +20 more potentially affected by CVE-2026-33128 via h3 (>=2.0.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0, =3.23.1-20260131-121433-34f631e, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =0.1.7, =0.3.1-beta.5, =0.0.1-beta.1, =1.0.1, =1.0.3 and more Source cves: CVE-2026-33128 Source advisory: SNYK:JS-H3-15692480...

CRLF Injection

Overview org.webjars.npm:h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized input in the formatEventStreamMessage and formatEventStreamComment functions. An attacker can inject arbitrary...

CRLF Injection

Overview h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized input in the formatEventStreamMessage and formatEventStreamComment functions. An attacker can inject arbitrary Server-Sent Events...

@abysslabs/cli (=0.0.2), @nuxt/test-utils (=4.0.0) +20 more potentially affected by CVE-2026-33128 via h3 (>=2.0.0 <=2.0.1-rc.14)

h3 NPM version =2.0.0, =3.23.1-20260131-121433-34f631e, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =1.154.7, =0.1.7, =0.3.1-beta.5, =0.0.1-beta.1, =1.0.1, =1.0.3 and more Source cves: CVE-2026-33128 Source advisory: OSV:GHSA-22CC-P3C6-WPVM...

GHSA-MP2G-9VG9-F4CG h3 v1 has Request Smuggling (TE.TE) issue

I was digging into h3 v1 specifically v1.15.4 and found a critical HTTP Request Smuggling vulnerability. Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. The...

0xkit (=0.0.1), 0xpass (>=0.0.11 <=0.1.26) +7842 more potentially affected by CVE-2026-23527 via h3 (>=1.0.1 <=1.15.4)

h3 NPM version =1.0.1, =0.0.11, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.0.2, =0.1.0, =1.1.0, =0.1.0, =0.1.0, =1.0.21, =2.0.0, =0.1.4, =0.1.0, =1.0.10, =1.0.11 and more Source cves: CVE-2026-23527 Source advisory: SNYK:JS-H3-15010914...

HTTP Request Smuggling

Overview h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to HTTP Request Smuggling via improper parsing of the Transfer-Encoding header in the readRawBody function. An attacker can bypass security controls and poison web...

CVE-2026-23527 h3 v1 has Request Smuggling (TE.TE) issue

H3 is a minimal HTTP framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this heade...

EUVD-2026-2737

H3 is a minimal HTTP framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this heade...

CVE-2026-23527

CVE-2026-23527 affects the h3 HTTP framework (pre-1.15.5). The vulnerability is in readRawBody, which performs a strict case-sensitive check for the Transfer-Encoding header and looks for the literal value “chunked.” Because RFC requires case-insensitive handling, an attacker can craft a request ...

PT-2026-3098

Name of the Vulnerable Software and Affected Versions H3 versions prior to 1.15.5 Description H3 is a minimal HTTP framework designed for high performance and portability. A critical HTTP Request Smuggling issue exists due to a case-sensitive check for the 'Transfer-Encoding' header within the...

EUVD-2006-4243

Malware in sbrugna...

EUVD-2006-5434

Malware in sbrugna...

Malicious code in @zalastax/nolb-_h3 (npm)

The package @zalastax/nolb-h3 was found to contain malicious code...

MAL-2025-10063 Malicious code in @zalastax/nolb-_h3 (npm)

The package @zalastax/nolb-h3 was found to contain malicious code...

SQUICD (>=0.1.0 <=0.1.1), bolic-network (=0.0.1) +7 more potentially affected by CVE-2025-7054 via quiche (>=0.16.0 <=0.22.0)

quiche CARGO version =0.16.0, =0.1.0, =0.2.4, =0.0.1, =0.0.2 - quiche-async =0.0.0 - quiche-tokio =0.1.0 - quiver-h3 =0.1.0 Source cves: CVE-2025-7054 Source advisory: OSV:GHSA-M3HH-F9GH-74C2...

Malicious code in nebulagl-h3-hexagon-editing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbf7cb7b134f7a3699367939a1d01f6863a30cbc599d8973b3c57509cd51c9b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for haproxy

This update for haproxy fixes the following issues: Update to version 2.8.11+git0.01c1056a4: VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server bsc1233973 BUG/MINOR: cfgparse-listen: fix option httpslog overrid...

SUSE-SU-2025:20101-1 Security update for haproxy

This update for haproxy fixes the following issues: Update to version 2.8.11+git0.01c1056a4: - VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server bsc1233973 - BUG/MINOR: cfgparse-listen: fix option httpslog...