CVE-2026-33490 | h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Exp

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.

Published: 2026-03-26 Last update: 2026-03-31 Assigner: [email protected] Source: [email protected]

NVD Status：Analyzed，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2026-33490

EPSS CVSS CWE GHSA Exploit-DB Affected OS Tracker

Conclusion & alert: CVE-2026-33490 is rated Exploit Available (50/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.03%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2026-33490

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2026-33490

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-27	—	0.03%	—

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-33490

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
3.7	3.1	LOW	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.2	1.4	[email protected]
5.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	3.9	1.4	[email protected]

Weakness enumeration for CVE-2026-33490

CWE-706 MITRE ↗

GitHub Security Advisory for CVE-2026-33490

GHSA-2j6q-whv2-gh6w · Severity: low · Ecosystem: npm — h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

OS Trackers for CVE-2026-33490

vendor	priority	summary	link
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2026-33490

Affected software / configurations for CVE-2026-33490

Vendor	Product	Version	Raw CPE
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc1::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc10::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc11::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc12::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc13::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc14::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc15::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc16::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc2::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc3::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc4::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc5::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc6::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc7::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc8::::node.js::*
h3	h3	2.0.1	cpe:2.3:a:h3:h3:2.0.1:rc9::::node.js::*

References for CVE-2026-33490

URL	Tags
https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w	Exploit Mitigation Vendor Advisory

cvelogic Threat Intelligence