CVE-2026-33128 - Vulnerability Analysis

Overview

H3 < 1.15.6 and 2.0.0 through 2.0.1-rc.14 contain a Server-Sent Events (SSE) injection caused by missing newline sanitization in createEventStream functions, letting attackers inject arbitrary SSE events to clients, exploit requires control of SSE message fields.

Severity & Score

Impact

Attackers can inject arbitrary SSE events to connected clients, potentially leading to client-side script execution or manipulation.

Mitigation

Update to versions 1.15.6 or 2.0.1-rc.15 or later.

References

• https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187
• https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6
• https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🟠 CVE-2026-33128 - High (7.5) H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and format... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33128/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner