Launch Week Day 1: Announcing Security Design Review
Start for Free
npm

h3

View on npm registry
10 Total advisories
10 Vulnerabilities
0 Malware

Vulnerabilities

HIGH 8.9
npm

CVE-2026-23527

h3 v1 has Request Smuggling (TE.TE) issue
LOW 3.7
npm

CVE-2026-33490

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
MEDIUM 5.3
npm

GHSA-q5pr-72pq-83v3

H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
MEDIUM 5.4
npm

GHSA-fp4x-ggrf-wmc6

H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
HIGH 7.4
npm

CVE-2026-33131

h3 has a middleware bypass with one gadget
HIGH 7.5
npm

CVE-2026-33128

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
MEDIUM 5.9
npm

CVE-2026-33129

h3 has an observable timing discrepancy in basic auth utils
MEDIUM 5.9
npm

GHSA-72gr-qfp7-vwhw

h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
MEDIUM 5.3
npm

GHSA-4hxc-9384-m385

h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
MEDIUM 5.9
npm

GHSA-wr4h-v87w-p3r7

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes