An open index of dependabot pull requests across open source projects.

h3

Ecosystem:
npm
Package URL:
pkg:npm/h3
Total PRs:
3,411 Dependabot PRs
Latest PR:
6 days ago
Unique Repositories:
1,631 repositories
Unique Repos (30 days):
42 repositories
Security Advisories
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
GHSA-72gr-qfp7-vwhw MODERATE published 3 months ago • updated about 1 month ago
## Summary The `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed pe...
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
GHSA-2j6q-whv2-gh6w CVE-2026-33490 LOW published 3 months ago • updated 5 days ago
## Summary The `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-applicati...
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
GHSA-4hxc-9384-m385 MODERATE published 3 months ago • updated about 1 month ago
## Summary The `EventStream` class in h3 fails to sanitize carriage return (`\r`) characters in `data` and `comment` fields. Per the SSE specifica...
h3 has a middleware bypass with one gadget
GHSA-3vj8-jmxq-cgj5 CVE-2026-33131 HIGH published 3 months ago • updated 8 days ago
# H3 NodeRequestUrl bugs Vulnerable pieces of code : ```js import { H3, serve, defineHandler, getQuery, getHeaders, readBody, defineNodeHandler ...
h3 has an observable timing discrepancy in basic auth utils
GHSA-26f5-8h2x-34xh CVE-2026-33129 MODERATE published 3 months ago • updated 35 minutes ago
### Summary A Timing Side-Channel vulnerability exists in the `requireBasicAuth` function due to the use of unsafe string comparison (`!==`). This ...
Recent PRs (filtered by: Patch PRs )
Bump h3 from 1.15.6 to 1.15.11

samu9nai/myblog #55

1.15.6 → 1.15.11 Patch PR
Open 24 days ago 1 comment
samu9nai
Package Details
Name: h3
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/h3
JSON API: View JSON
Security Advisories

10

Active advisories
HIGH 3
MODERATE 6
LOW 1
View All npm Advisories
Package Information
Description:

Minimal H(TTP) framework built for high performance and portability.

Repository: https://github.com/unjs/h3
Homepage: https://github.com/unjs/h3#readme
Latest Release: 2.0.0
over 9 years ago
Dependent Repos: 10,648
Dependent Packages: 330
Downloads: 8,844,294
Ranking: Top 0.2447% by dependent repos Top 0.1619% by downloads Top 0.1607% by dependent pkgs
PR Status
Open 1,500 (44.0%)
Merged 11 (0.3%)
Closed 1,787 (52.4%)
PR Types
Major 7 (0.2%)
Minor 288 (8.4%)
Patch 2,963 (86.9%)
Removal 1 (0.0%)