h3 1.10.2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the h3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M CRLF Injection h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized carriage return characters in the `data` and `comment` fields of the EventStream class. An attacker can inject arbitrary server-sent events, spoof event types, and split a single event into multiple browser-parsed events by supplying specially crafted input containing carriage return characters. How to fix CRLF Injection? Upgrade `h3` to version 1.15.9, 2.0.1-rc.17 or higher.	<1.15.9>=2.0.0-beta.0 <2.0.1-rc.17
H Directory Traversal h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to Directory Traversal via the `serveStatic` utility. An attacker can access arbitrary files from backend storage by sending specially crafted requests containing percent-encoded dot segments, which are interpreted as directory traversal sequences by URL-based backends. How to fix Directory Traversal? Upgrade `h3` to version 1.15.9 or higher.	<1.15.9
H Timing Attack h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to Timing Attack via the `requireBasicAuth` function. An attacker can recover valid authentication credentials by measuring response times and deducing password characters one at a time through timing analysis of server responses. How to fix Timing Attack? Upgrade `h3` to version 1.15.8, 2.0.1-rc.9 or higher.	<1.15.8>=2.0.0-beta.0 <2.0.1-rc.9
M CRLF Injection h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized input in the `formatEventStreamMessage` and `formatEventStreamComment` functions. An attacker can inject arbitrary Server-Sent Events (SSE) fields or events to connected clients by supplying newline characters in the `id`, `event`, `data`, or comment fields, which can lead to cross-user content injection, phishing, event spoofing, forced client reconnections, or manipulation of event replay behavior. How to fix CRLF Injection? Upgrade `h3` to version 1.15.6, 2.0.1-rc.15 or higher.	<1.15.6>=2.0.0 <2.0.1-rc.15
H Directory Traversal h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to Directory Traversal via the `serveStatic()` function. An attacker can access arbitrary files outside the intended static directory by sending crafted HTTP requests containing percent-encoded dot segments (`%2e%2e`) in the URL path, which are improperly decoded and passed to filesystem operations without validation. Note: This affects any h3 application using `serveStatic()` running on Node.js (where the `FastURL` fast path is used). Applications running on runtimes that provide a pre-parsed URL object (e.g., Cloudflare Workers, Deno) may not be affected, as FastURL's raw string slicing is bypassed. How to fix Directory Traversal? Upgrade `h3` to version 1.15.6, 2.0.1-rc.15 or higher.	<1.15.6>=2.0.0-beta.0 <2.0.1-rc.15
H HTTP Request Smuggling h3 is a Minimal H(TTP) framework built for high performance and portability. Affected versions of this package are vulnerable to HTTP Request Smuggling via improper parsing of the Transfer-Encoding header in the `readRawBody()` function. An attacker can bypass security controls and poison web caches by sending specially crafted HTTP requests with case-variant headers. How to fix HTTP Request Smuggling? Upgrade `h3` to version 1.15.5 or higher.	<1.15.5

Vulnerability

Vulnerable Version

CRLF Injection

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to CRLF Injection via unsanitized carriage return characters in the data and comment fields of the EventStream class. An attacker can inject arbitrary server-sent events, spoof event types, and split a single event into multiple browser-parsed events by supplying specially crafted input containing carriage return characters.

How to fix CRLF Injection?

Upgrade h3 to version 1.15.9, 2.0.1-rc.17 or higher.

<1.15.9>=2.0.0-beta.0 <2.0.1-rc.17

Directory Traversal

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to Directory Traversal via the serveStatic utility. An attacker can access arbitrary files from backend storage by sending specially crafted requests containing percent-encoded dot segments, which are interpreted as directory traversal sequences by URL-based backends.

How to fix Directory Traversal?

Upgrade h3 to version 1.15.9 or higher.

<1.15.9

Timing Attack

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to Timing Attack via the requireBasicAuth function. An attacker can recover valid authentication credentials by measuring response times and deducing password characters one at a time through timing analysis of server responses.

How to fix Timing Attack?

Upgrade h3 to version 1.15.8, 2.0.1-rc.9 or higher.

<1.15.8>=2.0.0-beta.0 <2.0.1-rc.9

CRLF Injection

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to CRLF Injection via unsanitized input in the formatEventStreamMessage and formatEventStreamComment functions. An attacker can inject arbitrary Server-Sent Events (SSE) fields or events to connected clients by supplying newline characters in the id, event, data, or comment fields, which can lead to cross-user content injection, phishing, event spoofing, forced client reconnections, or manipulation of event replay behavior.

How to fix CRLF Injection?

Upgrade h3 to version 1.15.6, 2.0.1-rc.15 or higher.

<1.15.6>=2.0.0 <2.0.1-rc.15

Directory Traversal

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to Directory Traversal via the serveStatic() function. An attacker can access arbitrary files outside the intended static directory by sending crafted HTTP requests containing percent-encoded dot segments (%2e%2e) in the URL path, which are improperly decoded and passed to filesystem operations without validation.

Note:

This affects any h3 application using serveStatic() running on Node.js (where the FastURL fast path is used). Applications running on runtimes that provide a pre-parsed URL object (e.g., Cloudflare Workers, Deno) may not be affected, as FastURL's raw string slicing is bypassed.

How to fix Directory Traversal?

Upgrade h3 to version 1.15.6, 2.0.1-rc.15 or higher.

<1.15.6>=2.0.0-beta.0 <2.0.1-rc.15

HTTP Request Smuggling

h3 is a Minimal H(TTP) framework built for high performance and portability.

Affected versions of this package are vulnerable to HTTP Request Smuggling via improper parsing of the Transfer-Encoding header in the readRawBody() function. An attacker can bypass security controls and poison web caches by sending specially crafted HTTP requests with case-variant headers.

How to fix HTTP Request Smuggling?

Upgrade h3 to version 1.15.5 or higher.

<1.15.5

h3@1.10.2 vulnerabilities

Minimal H(TTP) framework built for high performance and portability.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically