Open Redirect Vulnerability in h3 Package: Protocol-Relative Path Issue
Summary
GHSA-fp4x-ggrf-wmc6: H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation. Affects h3 versions >= 2.0.1-rc.17, < 2.0.1-rc.18. Fixed in 2.0.1-rc.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The h3 package is a lightweight HTTP framework designed for building web applications and APIs in Node.js. It provides utilities for handling HTTP requests and responses, making it easier for developers to create server-side applications. However, a vulnerability has been identified in the redirectBack() function, which improperly validates the Referer header, allowing for potential open redirect attacks.
Vulnerability Detail
The vulnerability in the h3 package arises from the redirectBack() utility, which fails to sanitize the pathname extracted from the Referer header. This allows an attacker to craft a same-origin URL with a double-slash path segment, which passes the origin check but results in a Location header that browsers interpret as a protocol-relative redirect to an external domain. This can lead to credential phishing, OAuth token theft, and exploitation of user trust, as users may be redirected to malicious sites that mimic legitimate ones.
How To Fix
Latest published version: 2.0.8 as of 23 Oct 2026
npm install h3@2.0.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1-rc.18
This is the first release that contains the fix.
npm install h3@2.0.1-rc.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to validate the Referer header manually before calling redirectBack(). Ensure that the pathname does not start with double slashes. This can be done by implementing a custom redirect function that checks the pathname format.
Conclusion
The open redirect vulnerability in the h3 package poses a significant risk to applications using the redirectBack() function. It is crucial to update to the patched version and implement proper validation to mitigate potential attacks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for h3 →
FAQ
The vulnerability allows for open redirects due to improper validation of the Referer header in the h3 package.
An attacker can craft a URL that appears to be from the same origin but redirects users to a malicious site, potentially leading to phishing attacks.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Yes, the vulnerability has been patched in version 2.0.1-rc.18 of the h3 package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just package-lock.json. You can also check your application for this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for h3.
