5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33129

CVE-2026-33129: h3 has an observable timing discrepancy in basic auth utils

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33129

CVE-2026-33129:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
h3	npm	>= 2.0.0-beta.0, <= 2.0.0-rc.8	2.0.1-rc.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly identifies the requireBasicAuth function as the source of a timing side-channel vulnerability due to an unsafe string comparison. To confirm this and analyze the patch, I first identified the commit range between the last vulnerable version (2.0.0-rc.8) and the first patched version (2.0.1-rc.9) by querying the repository tags. Comparing the commits between these two tags revealed a key commit 4e091a6baadb7fe3708f3485b94b85c6457643d3 with the message "fix(basic-auth): use jitter and constant-time string comparison".

Analysis of this commit's diff shows that in the file src/utils/auth.ts, the requireBasicAuth function was modified. The vulnerable code, which used a simple !== comparison for the password, was removed:

-  if (opts.password && password !== opts.password) {
-    throw autheFailed(event, opts?.realm);
-  }

It was replaced with a call to a new timingSafeEqual function, which performs a constant-time comparison to prevent timing attacks:

+  if (
+    (opts.username && !timingSafeEqual(username, opts.username)) ||
+    (opts.password && !timingSafeEqual(password, opts.password)) ||
+    (opts.validate && !(await opts.validate(username, password)))
+  ) {
+    await randomJitter();
+    throw authFailed(event, opts?.realm);
+  }

This directly confirms that requireBasicAuth was the vulnerable function, as it contained the insecure comparison logic that was the root cause of the CVE.

Vulnerable functions

requireBasicAuth

src/utils/auth.ts

The function `requireBasicAuth` used the `!==` operator for string comparison when validating the provided password. This operator is not constant-time and returns as soon as a mismatching character is found, creating an observable timing discrepancy. An attacker can exploit this side-channel to guess the password one character at a time by measuring server response times.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.