h3js h3 vulnerabilities
10 published CVEs name h3js h3 among the affected products.
- 10Published CVEs10 of them scored
- 10Last 12 monthspublished in the last year
- 0Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-86253
h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
h3js · h3
High8.2 - CVE-2026-86252
h3 before 1.15.9 SSE Event Injection via Carriage Return
h3js · h3
Medium6.9 - CVE-2026-86251
h3 before 1.15.9 Path Traversal via Double Decoding
h3js · h3
High8.2 - CVE-2026-86250
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
h3js · h3
High8.7 - CVE-2026-86205
h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
h3js · h3
Medium5.3 - CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
h3js · h3
Low3.7 - CVE-2026-33131
h3 has a middleware bypass with one gadget
h3js · h3
High7.4 - CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
h3js · h3
Medium5.9 - CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
h3js · h3
High7.5 - CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
h3js · h3
High8.9