CVE-2026-33490: h3 Package Suffers from Missing Path Segment Boundary Check Leading to Middleware Execution on Unrelated Routes
Summary
CVE-2026-33490: The mount() method in h3 uses a simple startsWith() check to determine whether incoming requests fall under a mounted sub-application's path prefix. Affects h3 versions >= 2.0.1-alpha.0, < 2.0.1-rc.17. Fixed in 2.0.1-rc.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The h3 package is a lightweight HTTP framework for building web applications in Node.js. It provides a simple API for handling requests and responses, making it easy for developers to create robust applications. However, a recent vulnerability has been identified that allows middleware to execute on unintended routes due to a lack of proper path segment boundary checks.
Vulnerability Detail
The vulnerability arises from the mount() method in h3, which uses a startsWith() check to determine if incoming requests match a mounted sub-application's path prefix. This check fails to verify that the next character after the base path is a segment boundary (such as a forward slash or the end of the string). As a result, middleware registered for a path like '/admin' can also execute for unrelated paths like '/admin-public' or '/administrator'. This can lead to context pollution, where unauthorized access flags are set on requests that should not have them, potentially allowing attackers to bypass authorization checks.
How To Fix
Latest published version: 2.0.8 as of 23 Oct 2026
npm install h3@2.0.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1-rc.17
This is the first release that contains the fix.
npm install h3@2.0.1-rc.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually check the path segment boundaries in your middleware logic to prevent unauthorized access. For example:
app.use((event, next) => {
const originalPathname = event.url.pathname;
if (originalPathname.startsWith('/admin') &&
(originalPathname.length === 6 || originalPathname[6] === '/')) {
// Proceed with admin middleware
event.context.isAdmin = true;
}
next();
});
Conclusion
The h3 package has a vulnerability that allows middleware to execute on unintended routes due to missing path segment boundary checks. It is crucial to update to the patched version to prevent potential security risks. Implementing the suggested workaround can help mitigate the issue until an update is feasible.
See every vulnerability recorded for h3 →
FAQ
The vulnerability can lead to context pollution and unauthorized access, allowing attackers to trigger middleware intended for different routes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
All versions of h3 up to 2.0.1-rc.16 are affected by this vulnerability.
Implement the provided workaround to mitigate the risk until you can update to the patched version.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for h3.
