Description

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.

INFO

Published Date :

2026-03-26T17:19:15.956Z

Last Modified :

2026-03-26T18:23:39.653Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-33490 vulnerability.

Vendors Products
H3js
  • H3
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33490.

URL Resource
https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-33490 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-33490 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact