CVE-2026-33128 h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

High 7.5 Published 20 Mar 2026 Updated 20 Mar 2026

Attackers can inject arbitrary Server-Sent Events into client streams via unsanitized newlines in H3 framework event fields.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33128?

CVE-2026-33128 is a high-severity vulnerability in h3js h3, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Weakness: CWE-93

Which versions are affected by CVE-2026-33128?

4 open source packages ship an affected version, including h3. It affects 1 product.

Package	Affected	Fixed in
`h3` npm	All versions	`1.15.6`
`h3` npm	All versions	`1.15.6`
`h3` npm	From `2.0.0`	`2.0.1-rc.15`
`h3` npm	From `2.0.0`	`2.0.1-rc.15`

Products include H3 H3.

How do I fix CVE-2026-33128?

Upgrade h3 to a fixed version for your release line: 1.15.6 or 2.0.1-rc.15.

Is CVE-2026-33128 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33128 exists.

Sources

Also known as GHSA-22cc-p3c6-wpvm.