Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33128h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

High 7.5

In plain English

A high-severity security flaw in h3 from h3js. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	h3	2.0.1-rc.15	GHSA-22cc-p3c6-wpvm
npm	h3	1.15.6	GHSA-22cc-p3c6-wpvm

Affected products (as reported)

Vendor	Product	Versions
h3js	h3	>= 2.0.0, < 2.0.1-rc.15< 1.15.6

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References

https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm x_refsource_CONFIRM
https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6 x_refsource_MISC
https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187 x_refsource_MISC