CVE-2026-33128 is a high severity (CVSS 7.5) injection flaw in H3, the minimal HTTP framework used by Nitro and Nuxt. createEventStream does not strip newlines from event fields, so injected events can reach connected clients. Upgrade h3 to 1.15.6 or 2.0.1-rc.15 or later.
What's affected
The record lists H3 versions before 1.15.6 and versions from 2.0.0 through 2.0.1-rc.14. The GitHub advisory (GHSA-22cc-p3c6-wpvm) gives the patched range as 1.15.6 up to but not including 2.0.0-0, or 2.0.1-rc.15 and later.
Only applications that use createEventStream are in scope, and the risk grows when any part of an event message comes from user input.
How to check if you're exposed
Find which h3 version your project resolves, including through Nitro or Nuxt:
npm ls h3
Then search your source for createEventStream and check whether the id, event, data or comment values include request input or stored user content.
What to do now
- Upgrade h3 to 1.15.6 on the 1.x line, or to 2.0.1-rc.15 or later on 2.x.
- If h3 arrives through Nuxt or Nitro, update those packages or add a lockfile override so the patched h3 is resolved.
- Until you upgrade, strip carriage return and line feed characters from any user influenced value before it goes into an event stream.
- Rebuild and redeploy, then re-run npm ls h3 to confirm.
Why it matters
The weakness is CWE-93, improper neutralization of CRLF sequences. Server-Sent Events use newlines to separate fields and events. The advisory shows that formatEventStreamMessage and formatEventStreamComment write field values without removing those newlines.
An attacker who controls any part of a message can therefore end it early and add events of their own. Clients then receive messages the server never meant to send. The attack complexity is rated high because the attacker needs a path to put data into a stream. The record does not mark it as listed in CISA KEV.
Quick check
Does this affect every H3 app?
No. It affects apps that call createEventStream and pass attacker influenced text into message fields.
Sources
Last reviewed: 19 October 2026.
