npm/h3 CVE-2026-33131: high 7.4, EPSS 0.40%
h3 has a middleware bypass with one gadget
Action: Upgrade h3 to 2.0.1-rc.15 or later.
npm i h3@2.0.1-rc.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-0 | 2.0.1-rc.15 | - |
Fixed versions
| 2.0.1-rc.15 |
Sources
- osv: GHSA-3vj8-jmxq-cgj5
- https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5
- https://nvd.nist.gov/vuln/detail/CVE-2026-33131
- https://github.com/h3js/h3
CVE-2026-33131 · published · modified · JSON