CVE-2026-33131

HighPublic PoC

Published: 20 March 2026

Published

20 March 2026

Modified

20 March 2026

KEV Added

—

Patch

—

CVSS Score 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0003 7.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33131 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in H3 H3. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Mandates timely identification, reporting, and correction of the Host header spoofing flaw in H3's NodeRequestUrl, directly enabling patching to version 2.0.1-rc.15 or later.

SI-10 Information Input Validation good match

prevent

Requires validation of untrusted HTTP inputs like the Host header to block spoofing that causes faulty URL construction and middleware bypass.

AC-3 Access Enforcement partial match

prevent

Enforces logical access controls to mitigate bypass of authentication and authorization middleware via crafted Host headers targeting sensitive routes.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Host header spoofing in public-facing H3 web framework middleware directly enables remote exploitation of a public-facing application to bypass authentication/authorization checks and gain unauthorized access to endpoints.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the…

_url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.

Deeper analysisAI

CVE-2026-33131 is a Host header spoofing vulnerability in the NodeRequestUrl component, which extends FastURL, within the H3 minimal HTTP framework. It affects H3 versions from 2.0.0-0 through 2.0.1-rc.14 and any applications built on H3, such as those using Nitro or Nuxt. The flaw occurs when accessing properties like event.url, event.url.hostname, or event.url._url in middleware, as the _url getter constructs a URL from untrusted data including the user-controlled Host header. Because H3's router resolves the route handler before middleware execution, this enables bypass of authentication or authorization checks. The vulnerability is rated with a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-290 (Authentication Bypass by Spoofing).

An attacker can exploit this vulnerability remotely over the network without privileges by sending a crafted HTTP request with a manipulated Host header, such as "Host: localhost:3000/abchehe?". This causes middleware path checks—often used for logging or guarding sensitive routes—to fail due to the spoofed URL construction, while the router still matches the intended handler path. Successful exploitation allows bypassing security middleware, potentially granting unauthorized access to sensitive endpoints and resulting in high confidentiality and integrity impacts, such as data exposure or modification.

The GitHub security advisory at https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5 details the issue and confirms that H3 version 2.0.1-rc.15 includes a patch to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Security practitioners should immediately upgrade affected H3-based applications to the patched version or later to mitigate the risk.