7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33128

CVE-2026-33128: h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33128

CVE-2026-33128:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
h3	npm	>= 2.0.0, <= 2.0.1-rc.14	2.0.1-rc.15
h3	npm	< 1.15.6	1.15.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the h3 library's handling of Server-Sent Events (SSE). The core issue is the lack of newline sanitization in the formatEventStreamMessage and formatEventStreamComment functions located in src/utils/internal/event-stream.ts. The SSE protocol uses newline characters (\n) to delimit fields and a double newline (\n\n) to separate events. The vulnerable versions of these functions directly concatenated user-controllable data (such as event id, name, data, or a comment) into the event stream. An attacker could include newline characters in this data to break out of the intended field and inject new, malicious SSE fields or even entirely separate events. This could lead to spoofed events, fake messages in a chat application, or a denial-of-service attack by forcing clients into a rapid reconnection loop. The patch addresses this by introducing sanitization. For single-line fields like id and event, it strips newline characters. For the multi-line data field and comment, it correctly formats each line according to the SSE specification, preventing injection.

Vulnerable functions

formatEventStreamComment

src/utils/internal/event-stream.ts

The function is vulnerable because it directly includes the 'comment' parameter in the Server-Sent Events (SSE) stream without sanitizing newline characters. An attacker can provide a 'comment' string containing newline characters to inject new fields or complete events into the SSE stream, leading to content injection that will be processed by all connected clients.

formatEventStreamMessage

src/utils/internal/event-stream.ts

The function is vulnerable because it directly includes the 'id', 'event', and 'data' fields from the 'message' parameter into the Server-Sent Events (SSE) stream without sanitizing newline characters. An attacker can provide a specially crafted 'message' object with newlines in these fields to inject arbitrary SSE fields or entirely new events. This could be used for cross-user content injection, phishing, or causing a denial-of-service by forcing clients to reconnect rapidly.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.