CVE-2026-33490

The connected document provides concrete details for CVE-2026-33490: a missing path-segment boundary check in the h3 library allows a mounted sub-app at a base path (e.g., /admin) to leak middleware-induced context (such as isAdmin) to unrelated routes that merely share the string prefix (e.g., /...