h3js/h3 Security Advisories | GitStock

medium2026-03-23

H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation

GHSA-fp4x-ggrf-wmc6

medium2026-03-23

H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

GHSA-q5pr-72pq-83v3 · CVE-2026-86250

medium2026-03-20

h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

GHSA-4hxc-9384-m385

low2026-03-20

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

GHSA-2j6q-whv2-gh6w · CVE-2026-33490

medium2026-03-20

h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

GHSA-72gr-qfp7-vwhw

medium2026-03-18

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

GHSA-wr4h-v87w-p3r7

high2026-03-18

h3 has a middleware bypass with one gadget

GHSA-3vj8-jmxq-cgj5 · CVE-2026-33131

medium2026-03-18

h3 has an observable timing discrepancy in basic auth utils

GHSA-26f5-8h2x-34xh · CVE-2026-33129

high2026-03-18

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

GHSA-22cc-p3c6-wpvm · CVE-2026-33128

high2026-01-15

h3 v1 has Request Smuggling (TE.TE) issue

GHSA-mp2g-9vg9-f4cg · CVE-2026-23527