PT-2026-26775 · H3 · H3

Offset · Published 2026-03-20 · Updated 2026-03-26 · CVE-2026-33490

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions h3 versions 2.0.0-0 through 2.0.1-rc.16

Description The mount() method in h3 uses a simple startsWith() check to determine if incoming requests fall under a mounted sub-application's path prefix. This check does not verify a path segment boundary, meaning that middleware registered on a mount like /admin will also execute for unrelated routes such as /admin-public, /administrator, or /adminstuff. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. The withoutBase() utility also produces incorrect paths when the input shares only a string prefix, potentially causing routing errors. This issue can lead to context pollution across mount boundaries, authorization bypass, and path mangling.

Recommendations Versions prior to 2.0.2-rc.17 are affected. Apply the fix to src/h3.ts:127 to add a segment boundary check after the startsWith call. Apply the fix to src/utils/internal/path.ts:40 to add a segment boundary check after the startsWith call.

Exploit

Fix

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2026-33490

GHSA-2J6Q-WHV2-GH6W

Affected Products

H3

References · 8

• 🔥 https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33490.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33490 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j6q-whv2-gh6w · Vendor Advisory
• https://github.com/h3js/h3 · Note
• https://twitter.com/CVEnew/status/2037280606133117256 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037281310817820758 · Twitter Post