{"action":"Upgrade h3 to 2.0.1-rc.17 or later.","affected":[{"fixed":"2.0.1-rc.17","introduced":"2.0.1-alpha.0"}],"component":"h3","cve_ids":["CVE-2026-33490"],"ecosystem":"npm","epss":0.00248,"exploited":false,"fixed_versions":["2.0.1-rc.17"],"ghsa_id":"GHSA-2j6q-whv2-gh6w","id":"tcs_01M5KETBQD5NKC210AKN7ZEKGE","modified_at":"2026-03-27T21:16:22.484306Z","published_at":"2026-03-20T20:50:27Z","references":["https://osv.dev/vulnerability/GHSA-2j6q-whv2-gh6w","https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w","https://nvd.nist.gov/vuln/detail/CVE-2026-33490","https://github.com/h3js/h3"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-2j6q-whv2-gh6w","url":"https://osv.dev/vulnerability/GHSA-2j6q-whv2-gh6w"}],"summary":"h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"}