H3js
6 CVEs across 2 H3js products. Browse H3js vulnerabilities, severities, and proof-of-concept exploits.
H3js products with known CVEs
H3js CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-33732 | Medium | 4.8 | 2026-03-26 | srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the… |
CVE-2026-33490 | Low | 3.7 | 2026-03-26 | H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether i… |
CVE-2026-33131 | High | 7.4 | 2026-03-20 | H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastUR… |
CVE-2026-33129 | Medium | 5.9 | 2026-03-20 | H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to… |
CVE-2026-33128 | High | 7.5 | 2026-03-20 | H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE… |
CVE-2026-23527 | High | 8.9 | 2026-01-15 | H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRaw… |