CVE-2026-33128: h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
(updated )
createEventStream in h3 is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients.
References
- github.com/advisories/GHSA-22cc-p3c6-wpvm
- github.com/h3js/h3
- github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts
- github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6
- github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm
- nvd.nist.gov/vuln/detail/CVE-2026-33128
Code Behaviors & Features
Detect and mitigate CVE-2026-33128 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →