npmPackage

h3

10 known vulnerabilities (6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 2.0.8 (Oct 22, 2026): no advisory affects it
Newest unaffected release: 2.0.8 (Oct 22, 2026), the latest release
Advisories: 10 · 6 high, 3 medium, 1 low

Weekly downloads: 35.2M
Dependents: 952
Releases: 160 since 0.2.0 (Jan 12, 2021)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-86253
Affects 0.2.0 to 1.15.5 (1.15.6 is outside it); 2.0.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it)
CVE-2026-86252
Affects 0.2.0 to 1.15.8 (1.15.9 is outside it); 2.0.0-beta.0 to 2.0.1-rc.16 (2.0.1-rc.17 is outside it)
CVE-2026-86251
Affects 0.2.0 to 1.15.8 (1.15.9 is outside it)
CVE-2026-86250
Affects 2.0.0-beta.4 to 2.0.1-rc.17 (2.0.1-rc.18 is outside it)
CVE-2026-86205
Affects 2.0.1-rc.17 (2.0.1-rc.18 is outside it)
CVE-2026-33490
Affects 2.0.1-rc.1 to 2.0.1-rc.16 (2.0.1-rc.17 is outside it)
CVE-2026-33131
Affects 2.0.0-beta.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it)
CVE-2026-33129
Affects 2.0.0-beta.0 to 2.0.1-rc.8 (2.0.1-rc.9 is outside it)
CVE-2026-33128
Affects 0.2.0 to 1.15.5 (1.15.6 is outside it); 2.0.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it)
CVE-2026-23527
Affects 0.2.0 to 1.15.4 (1.15.5 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-86253High 8.2
h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
Affected: from 2.0.0, fixed in 2.0.1-rc.15; fixed in 1.15.6.
Fixed in 1.15.6 (released Mar 8, 2026, 182 days before disclosure) and 2.0.1-rc.15 (released Mar 8, 2026, 182 days before disclosure).
The latest release, 2.0.8, is not affected.
7.9% of h3 downloads last week were affected versions (3M).
CVE-2026-86252Medium 6.9
h3 before 1.15.9 SSE Event Injection via Carriage Return
Affected: from 2.0.0-beta.0, fixed in 2.0.1-rc.17; fixed in 1.15.9.
Fixed in 1.15.9 (released Mar 19, 2026, 171 days before disclosure) and 2.0.1-rc.17 (released Mar 19, 2026, 171 days before disclosure).
The latest release, 2.0.8, is not affected.
9.1% of h3 downloads last week were affected versions (3.5M).
CVE-2026-86251High 8.2
h3 before 1.15.9 Path Traversal via Double Decoding
Affected: fixed in 1.15.9.
Fixed in 1.15.9 (released Mar 19, 2026, 171 days before disclosure).
The latest release, 2.0.8, is not affected.
7.5% of h3 downloads last week were affected versions (2.9M).
CVE-2026-86250High 8.7
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
Affected: from 2.0.0-beta.4, fixed in 2.0.1-rc.18.
Fixed in 2.0.1-rc.18 (released Mar 21, 2026, 169 days before disclosure).
The latest release, 2.0.8, is not affected.
1.6% of h3 downloads last week were affected versions (605.1K).
CVE-2026-86205Medium 5.3
h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
Affected: from 2.0.1-rc.17, fixed in 2.0.1-rc.18.
Fixed in 2.0.1-rc.18 (released Mar 21, 2026, 169 days before disclosure).
The latest release, 2.0.8, is not affected.
<0.1% of h3 downloads last week were affected versions (8.4K).
CVE-2026-33490Low 3.7
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Affected: from 2.0.1-alpha.0, fixed in 2.0.1-rc.17.
Fixed in 2.0.1-rc.17 (released Mar 19, 2026, 7 days before disclosure).
The latest release, 2.0.8, is not affected.
1.3% of h3 downloads last week were affected versions (508K).
CVE-2026-33131High 7.4
h3 has a middleware bypass with one gadget
Affected: from 2.0.0-0, fixed in 2.0.1-rc.15.
Fixed in 2.0.1-rc.15 (released Mar 8, 2026, 12 days before disclosure).
The latest release, 2.0.8, is not affected.
1.3% of h3 downloads last week were affected versions (497.3K).
CVE-2026-33129Medium 5.9
h3 has an observable timing discrepancy in basic auth utils
Affected: from 2.0.0-beta.0, fixed in 2.0.1-rc.9.
Fixed in 2.0.1-rc.9 (released Jan 19, 2026, 60 days before disclosure).
The latest release, 2.0.8, is not affected.
0.9% of h3 downloads last week were affected versions (351.4K).
CVE-2026-33128High 7.5
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Affected: from 2.0.0, fixed in 2.0.1-rc.15; fixed in 1.15.6.
Fixed in 1.15.6 (released Mar 8, 2026, 12 days before disclosure) and 2.0.1-rc.15 (released Mar 8, 2026, 12 days before disclosure).
The latest release, 2.0.8, is not affected.
7.9% of h3 downloads last week were affected versions (3M).
CVE-2026-23527High 8.9
h3 v1 has Request Smuggling (TE.TE) issue
Affected: fixed in 1.15.5.
Fixed in 1.15.5 (released Jan 15, 2026, the day of disclosure).
The latest release, 2.0.8, is not affected.
5.8% of h3 downloads last week were affected versions (2.2M).