CVE-2026-33490 Details
Description
H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.
A vulnerability exists in the H3 framework, specifically in versions 2.0.0-0 through 2.0.1-rc.16. The issue arises in the 'mount()' method, where a 'startsWith()' check is used to determine if incoming requests match a mounted sub-application's path prefix. This check fails to verify path segment boundaries, allowing middleware from mounts like '/admin' to execute on unrelated routes such as '/admin-public', '/administrator', or '/adminstuff'. As a result, an attacker could trigger middleware that sets context flags for privileges, potentially accessing unauthorized functionalities. The vulnerability has been patched in version 2.0.1-rc.17.
Users can update to H3 version 2.0.1-rc.17 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| h3 h3 | 2.0.1 rc1 2.0.1 rc10 2.0.1 rc11 2.0.1 rc12 2.0.1 rc13 2.0.1 rc14 2.0.1 rc15 2.0.1 rc16 2.0.1 rc2 2.0.1 rc3 2.0.1 rc4 2.0.1 rc5 2.0.1 rc6 2.0.1 rc7 2.0.1 rc8 2.0.1 rc9 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |