SSE Injection Vulnerability in H3 Framework by H3
CVE-2026-33128
7.5HIGH
What is CVE-2026-33128?
The H3 framework is susceptible to Server-Sent Events (SSE) injection, which arises from insufficient newline sanitization in the methods formatEventStreamMessage() and formatEventStreamComment(). This vulnerability enables an attacker who has control over any subsection of an SSE message (such as id, event, data, or comment) to insert malicious SSE events into the streams sent to connected clients, potentially allowing for unauthorized data manipulation or disclosure. The vulnerability is addressed in H3 framework versions 1.15.6 and 2.0.1-rc.15.
Affected Version(s)
h3 >= 2.0.0, < 2.0.1-rc.15 < 2.0.0, 2.0.1-rc.15
h3 < 1.15.6 < 1.15.6