H3js vulnerabilities
We track 4 vulnerabilities in H3js products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 6, 2026.
Latest H3js vulnerabilities
- 7.5 High severity
h3: Uncontrolled Resource Consumption
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(
- 9.1 Critical severity
h3: Authentication Bypass by Spoofing
H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed,
- 10.0 Critical severity
h3: Improper Neutralization of CRLF Sequences
H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamCo
- 9.8 Critical severity
h3: Inconsistent Interpretation of HTTP Requests
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for