# h3 (npm) vulnerabilities 10 known vulnerabilities (6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.0.8 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 2.0.8 (Oct 22, 2026), the latest release - Weekly downloads: 35.2M - Dependents: 952 - Releases: 160 since 0.2.0 (Jan 12, 2021) - Registry: https://www.npmjs.com/package/h3 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-86253: 0.2.0 to 1.15.5 (1.15.6 is outside it); 2.0.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it) - CVE-2026-86252: 0.2.0 to 1.15.8 (1.15.9 is outside it); 2.0.0-beta.0 to 2.0.1-rc.16 (2.0.1-rc.17 is outside it) - CVE-2026-86251: 0.2.0 to 1.15.8 (1.15.9 is outside it) - CVE-2026-86250: 2.0.0-beta.4 to 2.0.1-rc.17 (2.0.1-rc.18 is outside it) - CVE-2026-86205: 2.0.1-rc.17 (2.0.1-rc.18 is outside it) - CVE-2026-33490: 2.0.1-rc.1 to 2.0.1-rc.16 (2.0.1-rc.17 is outside it) - CVE-2026-33131: 2.0.0-beta.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it) - CVE-2026-33129: 2.0.0-beta.0 to 2.0.1-rc.8 (2.0.1-rc.9 is outside it) - CVE-2026-33128: 0.2.0 to 1.15.5 (1.15.6 is outside it); 2.0.0 to 2.0.1-rc.14 (2.0.1-rc.15 is outside it) - CVE-2026-23527: 0.2.0 to 1.15.4 (1.15.5 is outside it) ## Advisories (10) ### [CVE-2026-86253](https://cve.now/CVE-2026-86253): h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments - Severity: High 8.2 - Published: Sep 6, 2026 - Affected: from 2.0.0, fixed in 2.0.1-rc.15; fixed in 1.15.6. - Fixed in 1.15.6 (released Mar 8, 2026, 182 days before disclosure) and 2.0.1-rc.15 (released Mar 8, 2026, 182 days before disclosure). - The latest release, 2.0.8, is not affected. - 7.9% of h3 downloads last week were affected versions (3M). ### [CVE-2026-86252](https://cve.now/CVE-2026-86252): h3 before 1.15.9 SSE Event Injection via Carriage Return - Severity: Medium 6.9 - Published: Sep 6, 2026 - Affected: from 2.0.0-beta.0, fixed in 2.0.1-rc.17; fixed in 1.15.9. - Fixed in 1.15.9 (released Mar 19, 2026, 171 days before disclosure) and 2.0.1-rc.17 (released Mar 19, 2026, 171 days before disclosure). - The latest release, 2.0.8, is not affected. - 9.1% of h3 downloads last week were affected versions (3.5M). ### [CVE-2026-86251](https://cve.now/CVE-2026-86251): h3 before 1.15.9 Path Traversal via Double Decoding - Severity: High 8.2 - Published: Sep 6, 2026 - Affected: fixed in 1.15.9. - Fixed in 1.15.9 (released Mar 19, 2026, 171 days before disclosure). - The latest release, 2.0.8, is not affected. - 7.5% of h3 downloads last week were affected versions (2.9M). ### [CVE-2026-86250](https://cve.now/CVE-2026-86250): h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie - Severity: High 8.7 - Published: Sep 6, 2026 - Affected: from 2.0.0-beta.4, fixed in 2.0.1-rc.18. - Fixed in 2.0.1-rc.18 (released Mar 21, 2026, 169 days before disclosure). - The latest release, 2.0.8, is not affected. - 1.6% of h3 downloads last week were affected versions (605.1K). ### [CVE-2026-86205](https://cve.now/CVE-2026-86205): h3 before 2.0.1-rc.18 Open Redirect via redirectBack() - Severity: Medium 5.3 - Published: Sep 6, 2026 - Affected: from 2.0.1-rc.17, fixed in 2.0.1-rc.18. - Fixed in 2.0.1-rc.18 (released Mar 21, 2026, 169 days before disclosure). - The latest release, 2.0.8, is not affected. - <0.1% of h3 downloads last week were affected versions (8.4K). ### [CVE-2026-33490](https://cve.now/CVE-2026-33490): h3: Missing Path Segment Boundary Check in \`mount()\` Causes Middleware Execution on Unrelated Prefix-Matching Routes - Severity: Low 3.7 - Published: Mar 26, 2026 - Affected: from 2.0.1-alpha.0, fixed in 2.0.1-rc.17. - Fixed in 2.0.1-rc.17 (released Mar 19, 2026, 7 days before disclosure). - The latest release, 2.0.8, is not affected. - 1.3% of h3 downloads last week were affected versions (508K). ### [CVE-2026-33131](https://cve.now/CVE-2026-33131): h3 has a middleware bypass with one gadget - Severity: High 7.4 - Published: Mar 20, 2026 - Affected: from 2.0.0-0, fixed in 2.0.1-rc.15. - Fixed in 2.0.1-rc.15 (released Mar 8, 2026, 12 days before disclosure). - The latest release, 2.0.8, is not affected. - 1.3% of h3 downloads last week were affected versions (497.3K). ### [CVE-2026-33129](https://cve.now/CVE-2026-33129): h3 has an observable timing discrepancy in basic auth utils - Severity: Medium 5.9 - Published: Mar 20, 2026 - Affected: from 2.0.0-beta.0, fixed in 2.0.1-rc.9. - Fixed in 2.0.1-rc.9 (released Jan 19, 2026, 60 days before disclosure). - The latest release, 2.0.8, is not affected. - 0.9% of h3 downloads last week were affected versions (351.4K). ### [CVE-2026-33128](https://cve.now/CVE-2026-33128): h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields - Severity: High 7.5 - Published: Mar 20, 2026 - Affected: from 2.0.0, fixed in 2.0.1-rc.15; fixed in 1.15.6. - Fixed in 1.15.6 (released Mar 8, 2026, 12 days before disclosure) and 2.0.1-rc.15 (released Mar 8, 2026, 12 days before disclosure). - The latest release, 2.0.8, is not affected. - 7.9% of h3 downloads last week were affected versions (3M). ### [CVE-2026-23527](https://cve.now/CVE-2026-23527): h3 v1 has Request Smuggling (TE.TE) issue - Severity: High 8.9 - Published: Jan 15, 2026 - Affected: fixed in 1.15.5. - Fixed in 1.15.5 (released Jan 15, 2026, the day of disclosure). - The latest release, 2.0.8, is not affected. - 5.8% of h3 downloads last week were affected versions (2.2M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/h3 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.