CVE-2026-33131
Published: 20 March 2026
Summary
CVE-2026-33131 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in H3 H3. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33131 is a Host header spoofing vulnerability in the NodeRequestUrl component, which extends FastURL, within the H3 minimal HTTP framework. It affects H3 versions from 2.0.0-0 through 2.0.1-rc.14 and any applications built on H3, such as those using Nitro or Nuxt. The flaw occurs when accessing properties like event.url, event.url.hostname, or event.url._url in middleware, as the _url getter constructs a URL from untrusted data including the user-controlled Host header. Because H3's router resolves the route handler before middleware execution, this enables bypass of authentication or authorization checks. The vulnerability is rated with a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-290 (Authentication Bypass by Spoofing).
An attacker can exploit this vulnerability remotely over the network without privileges by sending a crafted HTTP request with a manipulated Host header, such as "Host: localhost:3000/abchehe?". This causes middleware path checks—often used for logging or guarding sensitive routes—to fail due to the spoofed URL construction, while the router still matches the intended handler path. Successful exploitation allows bypassing security middleware, potentially granting unauthorized access to sensitive endpoints and resulting in high confidentiality and integrity impacts, such as data exposure or modification.
The GitHub security advisory at https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5 details the issue and confirms that H3 version 2.0.1-rc.15 includes a patch to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Security practitioners should immediately upgrade affected H3-based applications to the patched version or later to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13672
Vulnerability details
H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the…
more
_url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Host header spoofing in public-facing H3 web framework middleware directly enables remote exploitation of a public-facing application to bypass authentication/authorization checks and gain unauthorized access to endpoints.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of the Host header spoofing flaw in H3's NodeRequestUrl, directly enabling patching to version 2.0.1-rc.15 or later.
Requires validation of untrusted HTTP inputs like the Host header to block spoofing that causes faulty URL construction and middleware bypass.
Enforces logical access controls to mitigate bypass of authentication and authorization middleware via crafted Host headers targeting sensitive routes.