by Kastro
Paper/Archive/CVE-2026-33128

CVE-2026-33128

h3js h3 — h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

EPSS 0.6%public exploitCVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 47.9.479 × 209.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Affected

ProductAffectedFixed inSource
h3>= 2.0.0, < 2.0.1-rc.15–CNA
h3< 1.15.6–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvmrefgithub.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6refgithub.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187