CVE-2026-33128 PUBLISHED

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Assigner: GitHub_M
Reserved: 17.03.2026 Published: 20.03.2026 Updated: 20.03.2026

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor h3js
Product h3
Versions
  • Version >= 2.0.0, < 2.0.1-rc.15 is affected
  • Version < 1.15.6 is affected

References

Problem Types

  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') CWE