h3 (npm)
Advisories
28
Latest version
2.0.8
Released Oct 22, 2026
License
MIT
OpenSSF Scorecard
—
How to fix
Upgrading to 2.0.1-rc.18 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install h3@2.0.8yarn
yarn add h3@2.0.8pnpm
pnpm add h3@2.0.8Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-fg72-q65g-wm5w Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service Withdrawn |
High | >= 2.0.0-beta.4 | No fix yet |
| GHSA-fg72-q65g-wm5w Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service Withdrawn |
High | >= 2.0.0-beta.4, < 2.0.1-rc.18 | 2.0.1-rc.18 |
| GHSA-fp4x-ggrf-wmc6 H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation |
Medium EPSS 0.27% |
No fix yet | |
| GHSA-fp4x-ggrf-wmc6 H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation |
Medium EPSS 0.27% |
>= 2.0.1-rc.17, < 2.0.1-rc.18 | 2.0.1-rc.18 |
| GHSA-q5pr-72pq-83v3 H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service |
High EPSS 0.49% |
>= 2.0.0-beta.4, < 2.0.1-rc.18 | 2.0.1-rc.18 |
| GHSA-q5pr-72pq-83v3 H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service |
High EPSS 0.49% |
>= 2.0.0-beta.4, < 2.0.1-rc.18 | 2.0.1-rc.18 |
| GHSA-4hxc-9384-m385 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) |
Medium EPSS 0.36% |
>= 2.0.0-beta.0, < 2.0.1-rc.17 | 2.0.1-rc.17 |
| GHSA-4hxc-9384-m385 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) |
Medium EPSS 0.36% |
< 1.15.9 | 1.15.9 |
| GHSA-4hxc-9384-m385 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) |
Medium EPSS 0.36% |
< 1.15.9 | 1.15.9 |
| GHSA-4hxc-9384-m385 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix) |
Medium EPSS 0.36% |
>= 2.0.0-beta.0, <= 2.0.1-rc.16 | No fix yet |
| GHSA-2j6q-whv2-gh6w h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes |
Medium EPSS 0.25% |
>= 2.0.1-alpha.0, <= 2.0.1-rc.16 | No fix yet |
| GHSA-2j6q-whv2-gh6w h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes |
Medium EPSS 0.25% |
>= 2.0.1-alpha.0, < 2.0.1-rc.17 | 2.0.1-rc.17 |
| GHSA-72gr-qfp7-vwhw h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e` |
High EPSS 0.43% |
< 1.15.9 | 1.15.9 |
| GHSA-72gr-qfp7-vwhw h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e` |
High EPSS 0.43% |
<= 1.15.8 | No fix yet |
| GHSA-wr4h-v87w-p3r7 h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read |
High EPSS 0.62% |
< 1.15.6 | 1.15.6 |
| GHSA-wr4h-v87w-p3r7 h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read |
High EPSS 0.62% |
>= 2.0.0, < 2.0.1-rc.15 | 2.0.1-rc.15 |
| GHSA-wr4h-v87w-p3r7 h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read |
High EPSS 0.62% |
>= 2.0.0, <= 2.0.1-rc.14 | No fix yet |
| GHSA-wr4h-v87w-p3r7 h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read |
High EPSS 0.62% |
< 1.15.6 | 1.15.6 |
| GHSA-3vj8-jmxq-cgj5 h3 has a middleware bypass with one gadget |
Critical EPSS 0.40% |
>= 2.0.0-0, < 2.0.1-rc.15 | 2.0.1-rc.15 |
| GHSA-3vj8-jmxq-cgj5 h3 has a middleware bypass with one gadget |
Critical EPSS 0.40% |
>= 2.0.0-0, < 2.0.1-rc.15 | 2.0.1-rc.15 |
| GHSA-26f5-8h2x-34xh h3 has an observable timing discrepancy in basic auth utils |
Medium EPSS 0.32% |
>= 2.0.0-beta.0, < 2.0.1-rc.9 | 2.0.1-rc.9 |
| GHSA-26f5-8h2x-34xh h3 has an observable timing discrepancy in basic auth utils |
Medium EPSS 0.32% |
>= 2.0.0-beta.0, <= 2.0.0-rc.8 | No fix yet |
| GHSA-22cc-p3c6-wpvm h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields |
Critical EPSS 0.58% |
>= 2.0.0, < 2.0.1-rc.15 | 2.0.1-rc.15 |
| GHSA-22cc-p3c6-wpvm h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields |
Critical EPSS 0.58% |
< 1.15.6 | 1.15.6 |
| GHSA-22cc-p3c6-wpvm h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields |
Critical EPSS 0.58% |
>= 2.0.0, <= 2.0.1-rc.14 | No fix yet |
| GHSA-22cc-p3c6-wpvm h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields |
Critical EPSS 0.58% |
< 1.15.6 | 1.15.6 |
| GHSA-mp2g-9vg9-f4cg h3 v1 has Request Smuggling (TE.TE) issue |
Critical EPSS 0.63% |
< 1.15.5 | 1.15.5 |
| GHSA-mp2g-9vg9-f4cg h3 v1 has Request Smuggling (TE.TE) issue |
Critical EPSS 0.63% |
<= 1.15.4 | No fix yet |
Source: h3js/h3
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor