Path Segment Boundary Flaw in H3 Framework Affects Middleware Functionality

CVE-2026-33490

What is CVE-2026-33490?

The H3 framework has a vulnerability originating from an improper validation in the mount() method where a simplistic startsWith() check is performed. This method fails to ensure proper path segment boundaries, allowing middleware registered on a specific path, such as /admin, to respond to unrelated routes like /admin-public, /administrator, or /adminstuff. As a result, an attacker could exploit this flaw to trigger middleware unwittingly, thereby injecting inappropriate privilege flags into the request context. Users are advised to upgrade to version 2.0.2-rc.17 to mitigate this issue. More details can be found in the advisory.

References