Timing Side-Channel Vulnerability in H3 Framework
CVE-2026-33129

5.9MEDIUM

Key Information:

Vendor

H3js

Status
H3
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33129?

The H3 framework versions 2.0.1-beta.0 through 2.0.0-rc.8 are susceptible to a timing side-channel vulnerability within the requireBasicAuth function. This issue is rooted in the improper use of string comparison operators, which allows attackers to infer valid password characters based on server response times. By strategically measuring these response times, a malicious actor can systematically bypass password complexity requirements, posing significant security risks. To mitigate this vulnerability, users are advised to update to version 2.0.1-rc.9, where the issue has been addressed.

Affected Version(s)

h3 >= 2.0.1-beta.0, < 2.0.1-rc.9

References

https://github.com/h3js/h3/security/advisories/GHSA-26f5-...
x_refsource_CONFIRM
https://github.com/h3js/h3/pull/1283
x_refsource_MISC
https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.