EUVD-2026-72108
GHSA-jqj6-8hxr-7wwq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable injection with no auth or user interaction required; impact bounded to limited integrity (fake SSE events), no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 npm packages depend on h3 (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0-beta.0.
DescriptionCVE.org
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
AnalysisAI
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2.0.1-rc.17 beta) allows remote attackers to inject arbitrary Server-Sent Events by embedding carriage return (\r) characters in data or comment fields that are reflected into the EventStream. Because the HTML SSE specification treats \r as a valid line terminator, browsers parse injected \r sequences as field boundaries - enabling attackers to spoof event types, split a single push call into multiple distinct browser-parsed events, or escape comment fields to deliver fake data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to both be true: (1) the h3 application uses the `EventStream` class to serve SSE responses, and (2) the application reflects attacker-influenced strings - from query parameters, request headers, request body fields, or other user-controlled sources - into the `data` or `comment` arguments of SSE push calls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) accurately captures the network-reachable, low-complexity nature of the injection and the bounded integrity-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the h3 npm package to version 1.15.9 or later on the stable branch, or to 2.0.1-rc.17 or later on the pre-release branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in H3 framework versions before 1.15.5 allows remote attackers to bypass security controls by exp
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote a
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arb
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary e
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today