CVE-2026-33129: h3 Package Timing Side-Channel Vulnerability in Basic Auth Utilities
Summary
CVE-2026-33129: h3 has an observable timing discrepancy in basic auth utils. Affects h3 versions >= 2.0.0-beta.0, < 2.0.1-rc.9. Fixed in 2.0.1-rc.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The h3 package is a high-performance HTTP/3 client and server implementation for Node.js, designed to provide efficient and reliable communication over the internet. It is widely used in modern web applications to leverage the benefits of HTTP/3, such as reduced latency and improved connection handling. However, a critical vulnerability has been identified in its basic authentication utilities, which could potentially expose sensitive user credentials to attackers.
Vulnerability Detail
A Timing Side-Channel vulnerability exists in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. The vulnerability is caused by the optimization of the !== operator, which returns false immediately upon encountering the first mismatched byte, allowing attackers to exploit timing differences to recover passwords.
How To Fix
Latest published version: 2.0.8 as of 23 Oct 2026
npm install h3@2.0.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1-rc.9
This is the first release that contains the fix.
npm install h3@2.0.1-rc.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a constant-time string comparison function to replace the unsafe comparison in the requireBasicAuth function. Here is an example of a constant-time comparison function:
function constantTimeCompare(a, b) {
if (a.length !== b.length) return false;
let result = 0;
for (let i = 0; i < a.length; i++) {
result |=
a.charCodeAt(i) ^ b.charCodeAt(i);
}
return result === 0;
}
Use this function in place of the !== operator to mitigate the timing attack risk.
Conclusion
The h3 package has a critical Timing Side-Channel vulnerability that can expose user credentials through timing attacks. It is essential to update to the patched version to mitigate this risk. Implementing constant-time string comparison can serve as a temporary workaround while ensuring your application remains secure.
See every vulnerability recorded for h3 →
FAQ
The vulnerability is a Timing Side-Channel issue that allows attackers to exploit response time discrepancies to recover passwords character-by-character.
If you are using h3 version 2.0.0-rc.8 or earlier, your application is vulnerable. You can check your package-lock.json file or use Vulert to monitor for vulnerabilities.
Attackers can recover user passwords, significantly reducing the complexity of cracking passwords from exponential to linear, especially in local or cloud environments.
Yes, the patch is available in h3 version 2.0.1-rc.9 and later. Updating to this version will resolve the vulnerability.
Vulert uses your package-lock.json to monitor and alert you in real-time for open-source vulnerabilities, allowing you to stay informed without needing to access the code or install additional tools.
References
Related vulnerabilities
Recent vulnerabilities recorded for h3.
