CVE-2026-33128 - Vulnerability Analysis

Overview

H3 < 1.15.6 and 2.0.0 through 2.0.1-rc.14 contain a Server-Sent Events (SSE) injection caused by missing newline sanitization in createEventStream functions, letting attackers inject arbitrary SSE events to clients, exploit requires control of SSE message fields.

Severity & Score

Impact

Attackers can inject arbitrary SSE events to connected clients, potentially leading to client-side script execution or manipulation.

Mitigation

Update to versions 1.15.6 or 2.0.1-rc.15 or later.

References

• https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187
• https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6
• https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner