PT-2026-26194 · Nuxt+3 · Nuxt+3
Hibwyli
·
Publicado
2026-03-18
·
Atualizado
2026-03-22
·
CVE-2026-33131
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
H3 versions 2.0.0-0 through 2.0.1-rc.14
Description
H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing issue in the NodeRequestUrl (which extends FastURL) that allows bypassing middleware. When
event.url, event.url.hostname, or event.url. url is accessed, such as in logging middleware, the url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3’s router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue arises because the FastURL.href is constructed with unsanitized, attacker-controlled input. The url() function within the FastURL class is triggered when accessing properties like event.url, leading to the construction of a URL using the potentially manipulated Host header. This allows an attacker to overwrite the event.url and bypass middleware checks.Recommendations
Update to H3 version 2.0.1-rc.15 or later.
Exploit
Correção
Authentication Bypass by Spoofing
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fasturl
H3
Nitro
Nuxt