CVE-2026-33128

Estado: AnalizadaCrítica (10)—

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.69%
Percentil entre todas las CVEs puntuadas: 51
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

H3 — H3

CWE

CWE-93

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-33128",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33128",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-20T11:36:13.079547Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "h3js",
          "product": "h3",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.0.1-rc.15"
            },
            {
              "status": "affected",
              "version": "< 1.15.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-20T10:16:19.160",
  "references": [
    {
      "url": "https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15."
    },
    {
      "lang": "es",
      "value": "H3 es un framework H(TTP) mínimo. En versiones anteriores a la 1.15.6 y entre la 2.0.0 y la 2.0.1-rc.14, createEventStream es vulnerable a la inyección de Eventos Enviados por el Servidor (SSE) debido a la falta de saneamiento de nueva línea en formatEventStreamMessage() y formatEventStreamComment(). Un atacante que controla cualquier parte de un campo de mensaje SSE (id, evento, datos o comentario) puede inyectar eventos SSE arbitrarios a los clientes conectados. Este problema está solucionado en las versiones 1.15.6 y 2.0.1-rc.15."
    }
  ],
  "lastModified": "2026-06-17T10:36:59.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h3:h3:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B8C8545-3682-40FD-A897-6729997A94E7",
              "versionEndExcluding": "1.15.6"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A80DE960-665D-4590-B6D5-645099B808E2"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "603A08FC-B20B-4693-90A1-0BF5F08B43AC"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCC5ECF0-0EED-48BC-95FA-1D2671A971A9"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCCBE75E-DCF6-45FD-B57E-F8E2ADE3129F"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B66082C-3F3E-4BC6-9543-A2F9CFE3AAC6"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D1C9D7B-3CE4-427B-93B4-EAF867159AFB"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5E7779A-00CA-45E7-8F68-1DAB5388ED4A"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "064C21F5-8633-45F3-9A3D-3FB029A867B9"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDBC1DFD-8063-4AE1-92D8-B3B33735FEF0"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496314A3-8F2B-4274-9D0D-7F11E896FEA5"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35F49342-D52C-4762-9369-F380C5E7E0B5"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D11CA1A7-3141-46EA-9687-32C333FC7B0C"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4A6FD03-5DE5-4D73-9FF3-BB653302C60B"
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E404148-6862-44F5-961D-10E8A742A4B6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}