Vulnerability details
CVE-2026-33128
h3js h3
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
CVSS 3.1
7.5High
Official description
H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| h3js | h3 | < 1.15.6 | CVEProject cvelistV5 (CNA) |
| h3js | h3 | >= 2.0.0, < 2.0.1-rc.15 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm x_refsource_CONFIRM
- https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6 x_refsource_MISC
- https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-20
- Last updated
- 2026-03-20
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.59%
Probability of exploitation in 30 days
48.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')