CVE-2026-33131 - Vulnerability Analysis

Overview

H3 2.0.0-0 through 2.0.1-rc.14 contains a host header injection caused by unsanitized user-controlled Host header in NodeRequestUrl leading to middleware bypass, letting attackers bypass authentication or authorization middleware, exploit requires crafted Host header.

Severity & Score

Impact

Attackers can bypass authentication or authorization middleware, potentially gaining unauthorized access to sensitive routes.

Mitigation

Upgrade to version 2.0.1-rc.15 or later.

References

• https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner