Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for h3. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.0.8 | Safe from 2.0.1 | |
| 1.15.11 | Safe from 1.15.9 | |
| 0.8.6 | 35 open advisories, worst high · last release Oct 2022, no longer updated |
- Highh3 has a middleware bypass with one gadgetGHSA-3vj8-jmxq-cgj5 · 18 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- Highh3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsGHSA-22cc-p3c6-wpvm · 18 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- 1.x1.0.0 – 1.15.5Fixed in 1.15.6
- 0.8.x and older0.2.0 – 0.8.6No fix, no longer updated · move to 1.15.6
- Highh3 v1 has Request Smuggling (TE.TE) issueGHSA-mp2g-9vg9-f4cg · 15 Jan 2026
- 1.x1.0.0 – 1.15.4Fixed in 1.15.5
- 0.8.x and older0.2.0 – 0.8.6No fix, no longer updated · move to 1.15.5
- ModerateH3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer ValidationGHSA-fp4x-ggrf-wmc6 · 23 Mar 2026
>= 2.0.1-rc.17, < 2.0.1-rc.18
- ModerateH3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of ServiceGHSA-q5pr-72pq-83v3 · 23 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- Moderateh3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)GHSA-4hxc-9384-m385 · 20 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- 1.x1.0.0 – 1.15.8Fixed in 1.15.9
- 0.8.x and older0.2.0 – 0.8.6No fix, no longer updated · move to 1.15.9
- Moderateh3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`GHSA-72gr-qfp7-vwhw · 20 Mar 2026
- 1.x1.0.0 – 1.15.8Fixed in 1.15.9
- 0.8.x and older0.2.0 – 0.8.6No fix, no longer updated · move to 1.15.9
- Moderateh3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File ReadGHSA-wr4h-v87w-p3r7 · 18 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- 1.x1.0.0 – 1.15.5Fixed in 1.15.6
- 0.8.x and older0.2.0 – 0.8.6No fix, no longer updated · move to 1.15.6
- Moderateh3 has an observable timing discrepancy in basic auth utilsGHSA-26f5-8h2x-34xh · 18 Mar 2026
- 2.x2.0.0Fixed in 2.0.1
- Lowh3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching RoutesGHSA-2j6q-whv2-gh6w · 20 Mar 2026
>= 2.0.1-alpha.0, < 2.0.1-rc.17
Registry facts last checked 26 Oct 2026. Releases and advisories last read 26 Oct 2026.