H3js H3 vulnerabilities

• h3js h3 h3 before 1.15.9 SSE Event Injection via Carriage Return CVE-2026-86252 6.9 MediumSeptember 6, 2026
• h3js h3 h3 before 2.0.1-rc.18 Open Redirect via redirectBack() CVE-2026-86205 Fix available 5.3 MediumMarch 23, 2026
• h3js h3 h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie CVE-2026-86250 Fix available 8.7 HighMarch 23, 2026
• h3 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes CVE-2026-33490 Fix available 3.7 LowMarch 20, 2026
• h3js h3 h3 before 1.15.9 Path Traversal via Double Decoding CVE-2026-86251 Fix available 8.2 HighMarch 20, 2026
• h3js h3 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments CVE-2026-86253 Fix available 8.2 HighMarch 18, 2026
• h3 h3 has a middleware bypass with one gadget CVE-2026-33131 Fix available 7.4 HighMarch 18, 2026
• h3 h3 has an observable timing discrepancy in basic auth utils CVE-2026-33129 Fix available 5.9 MediumMarch 18, 2026
• h3 h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields CVE-2026-33128 Fix available 7.5 HighMarch 18, 2026
• h3 h3 v1 has Request Smuggling (TE.TE) issue CVE-2026-23527 Fix available 8.9 HighJanuary 15, 2026