H3 2.0.1 Release Candidate 15 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:h3:h3:2.0.1:rc15:*:*:*:node.js:*:*
part: a version: 2.0.1 update: rc15
| Vendor | H3 (fe565e93-ff92-5d6a-80db-1462fbfb745d) |
|---|---|
| Product | H3 (f50cbc61-61b4-58fb-aeca-16ded3c21295) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33490 |
vulnerable | 2026-06-08 07:59:10.171511 |
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
LOW (3.7)
H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.
Published: 2026-03-26T17:19:15.956Z
Updated: 2026-03-26T18:23:39.653Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.