p PatchFirst

CVE-2026-33128

CVE-2026-33128 · h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

This page contains facts from public vulnerability sources. Check the original advisory before updating.

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • h3

    Versions
    • >= 2.0.0, < 2.0.1-rc.15: Affected
    • < 1.15.6: Affected

    No fix published

  • h3 npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.0.1-rc.15

    Update to 2.0.1-rc.15

  • h3 npm

    Affected ranges
    • SEMVER: < 1.15.6

    Update to 1.15.6

Original sources

Check your server →