An open index of dependabot pull requests across open source projects.

h3

Ecosystem:
npm
Package URL:
pkg:npm/h3
Total PRs:
3,421 Dependabot PRs
Latest PR:
about 1 month ago
Unique Repositories:
1,637 repositories
Unique Repos (30 days):
6 repositories
Security Advisories
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
GHSA-72gr-qfp7-vwhw MODERATE published 4 months ago • updated 17 days ago
## Summary The `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed pe...
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
GHSA-wr4h-v87w-p3r7 MODERATE published 5 months ago • updated 17 days ago
## Summary `serveStatic()` in h3 is vulnerable to path traversal via percent-encoded dot segments (`%2e%2e`), allowing an unauthenticated attacker...
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
GHSA-4hxc-9384-m385 MODERATE published 4 months ago • updated 2 days ago
## Summary The `EventStream` class in h3 fails to sanitize carriage return (`\r`) characters in `data` and `comment` fields. Per the SSE specifica...
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
GHSA-fp4x-ggrf-wmc6 MODERATE published 4 months ago • updated 17 days ago
## Summary The `redirectBack()` utility in h3 validates that the `Referer` header shares the same origin as the request before using its pathname ...
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
GHSA-2j6q-whv2-gh6w CVE-2026-33490 LOW published 4 months ago • updated 17 days ago
## Summary The `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-applicati...
Recent PRs
Bump h3 from 1.15.6 to 1.15.11

samu9nai/myblog #55

1.15.6 → 1.15.11 Patch PR
Open 3 months ago 1 comment
samu9nai
Package Details
Name: h3
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/h3
JSON API: View JSON
Security Advisories

10

Active advisories
HIGH 3
MODERATE 6
LOW 1
View All npm Advisories
Package Information
Description:

Minimal H(TTP) framework built for high performance and portability.

Repository: https://github.com/unjs/h3
Homepage: https://github.com/unjs/h3#readme
Latest Release: 2.0.0
almost 10 years ago
Dependent Repos: 10,648
Dependent Packages: 330
Downloads: 8,844,294
Ranking: Top 0.2447% by dependent repos Top 0.1619% by downloads Top 0.1607% by dependent pkgs
PR Status
Open 1,503 (43.9%)
Merged 11 (0.3%)
Closed 1,794 (52.4%)
PR Types
Major 7 (0.2%)
Minor 289 (8.4%)
Patch 2,972 (86.9%)
Removal 1 (0.0%)