CVE-2026-33131: High Middleware Bypass in H3 Host Handling

CVE-2026-33131 is a high severity (CVSS 7.4) Host header spoofing flaw in H3 2.x. A crafted Host header can make a path check in middleware fail while the route still matches, which can skip authentication. Upgrade h3 to 2.0.1-rc.15 or later.

What's affected

H3 versions from 2.0.0-0 up to but not including 2.0.1-rc.15, per the GitHub advisory (GHSA-3vj8-jmxq-cgj5). The patched version is 2.0.1-rc.15. The 1.x line is not listed as affected by this CVE.

The record says it affects applications built on H3, including Nitro and Nuxt, when middleware that guards sensitive routes reads event.url, event.url.hostname or event.url._url.

How to check if you're exposed

Check the resolved version:

npm ls h3

Then search your middleware for reads of event.url, including logging middleware that runs before an authorization check. Any app on a 2.0.x release candidate before rc.15 that does this should be treated as exposed.

What to do now

1. Upgrade h3 to 2.0.1-rc.15 or later, including through Nitro or Nuxt, and confirm with npm ls h3.
2. Do not rely on path checks inside middleware as the only guard for sensitive routes. Add an authorization check in the route handler as well.
3. Review logging and other middleware that touch event.url, since they are what trigger the problem.
4. Test your protected routes with unexpected Host values after the upgrade.

Why it matters

The weakness is CWE-290, authentication bypass by spoofing. The advisory explains that the router picks the handler before middleware runs. When middleware reads event.url, the URL is built from untrusted data, including the user supplied Host header.

That lets the path the middleware sees differ from the path the router matched. A guard that compares paths can then conclude the request is not for a protected route. The record does not mark this CVE as listed in CISA KEV.

Quick check

Sources

• H3 GitHub security advisory GHSA-3vj8-jmxq-cgj5

Last reviewed: 19 October 2026.