Approved changes feed: RSS · Atom
cpe:2.3:a:h3:h3:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | H3 (fe565e93-ff92-5d6a-80db-1462fbfb745d) |
|---|---|
| Product | H3 (f50cbc61-61b4-58fb-aeca-16ded3c21295) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33128 |
vulnerable | 2026-06-08 07:57:18.703359 |
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
HIGH (7.5)
H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.
Published: 2026-03-20T09:37:07.206Z
Updated: 2026-03-20T11:40:27.956Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23527 |
vulnerable | 2026-06-08 07:51:15.570466 |
h3 v1 has Request Smuggling (TE.TE) issue
HIGH (8.9)
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
Published: 2026-01-15T19:24:20.514Z
Updated: 2026-04-13T16:48:19.873Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.