Security
فارسی
All products

h3

npm · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of ServiceCVE-2026-86250 · GHSA-Q5PR-72PQ-83V3 h3 npm Medium Fix reported
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer ValidationCVE-2026-86205 · GHSA-FP4X-GGRF-WMC6 h3Red Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 npmRed Hat Medium Fix reported
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File ReadCVE-2026-86253 · GHSA-WR4H-V87W-P3R7 h3Red Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 npmRed Hat Medium Fix reported
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)CVE-2026-86252 · GHSA-4HXC-9384-M385 h3Red Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 npmRed Hat Medium Fix reported
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`CVE-2026-86251 · GHSA-72GR-QFP7-VWHW h3Red Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 npmRed Hat Medium Fix reported
h3 v1 has Request Smuggling (TE.TE) issueCVE-2026-23527 · GHSA-MP2G-9VG9-F4CG h3 npm High Fix reported
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching RoutesCVE-2026-33490 · GHSA-2J6Q-WHV2-GH6W h3 npm Low Fix reported
h3 has a middleware bypass with one gadgetCVE-2026-33131 · GHSA-3VJ8-JMXQ-CGJ5 h3 npm High Fix reported
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsCVE-2026-33128 · GHSA-22CC-P3C6-WPVM h3 npm High Fix reported
h3 has an observable timing discrepancy in basic auth utilsCVE-2026-33129 · GHSA-26F5-8H2X-34XH h3 npm Medium Fix reported