# CVE-2026-33128: h3 Server-Sent Events injection via unsanitized newlines

Source: https://junglewise.ai/threats/cve-2026-33128-h3js-h3-server-sent-events-injection-in-createeventstream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-18. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-33128 · Severity: low · CVSS 3.1 · Published 2026-03-18

h3 is a minimal HTTP framework used to build web services with Server-Sent Events (SSE) for real-time messaging. The framework fails to sanitize newline characters in SSE message fields (event, data, id, comment), allowing attackers who control any message field to inject arbitrary SSE events, forge privileged notifications, or trigger denial-of-service through reconnection manipulation. Applications using SSE for chat, notifications, or live dashboards are vulnerable to cross-user message injection and phishing attacks.

Technologies: [Uber H3-Js](https://junglewise.ai/threats/technologies/h3-js). Vendors: [Uber](https://junglewise.ai/threats/vendors/uber).

## Quick answers

**Is CVE-2026-33128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33128 being exploited in the wild.

**How severe is CVE-2026-33128?** Low severity, with a CVSS score of 3.1, published 18 March 2026.

**Which products and versions are affected?** Uber H3-Js < 1.15.6, >= 2.0.0 <= 2.0.1-rc.14.

**Is there a fix for CVE-2026-33128?** A patch was published on 2026-03-18: Fixed in v1.15.6 and v2.0.1-rc.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33128 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33128?** Check whether you run Uber H3-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CRLF injection (CWE-93) in the createEventStream functionality. The functions formatEventStreamMessage() and formatEventStreamComment() in src/utils/internal/event-stream.ts (lines 170–187) directly interpolate user-controlled strings into SSE wire format without removing newline characters (\n). Since the SSE protocol uses \n as a field delimiter and \n\n as an event separator, an attacker who controls any message field can inject arbitrary SSE directives (event:, data:, id:, retry:) or entirely new events. Attack vectors include network-accessible SSE endpoints in chat/notification applications, notification systems, and collaborative tools where user input flows into message fields. No authentication or user interaction is required—only the ability to influence a message field. Fixes are available in versions ≥1.15.6 (for v1.x) and ≥2.0.1-rc.15 (for v2.x).

## Affected products

- h3js h3 0 to 1.15.5; 2.0.0 to 2.0.1-rc.14

## Identifiers

- CVE-2026-33128
- GHSA-22cc-p3c6-wpvm

## Timeline

- 2026-03-18: disclosed: Advisory GHSA-22cc-p3c6-wpvm published
- 2026-03-18: patched: Fixed in v1.15.6 and v2.0.1-rc.15

## References

- [https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm](https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm)
- [https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6](https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6)
- [https://github.com/h3js/h3](https://github.com/h3js/h3)
- [https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts](https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts)

## Related threats

- [h3 missing path segment boundary check in mount()](https://junglewise.ai/threats/cve-2026-33490-h3js-h3-incorrect-path-validation-in-mount-method)
- [h3 middleware bypass via Host header spoofing](https://junglewise.ai/threats/cve-2026-33131-h3js-h3-middleware-bypass-via-host-header-spoofing)
- [h3 timing side-channel in basic auth validation](https://junglewise.ai/threats/cve-2026-33129-h3js-h3-timing-side-channel-in-requirebasicauth)
- [h3js h3 HTTP request smuggling in readRawBody](https://junglewise.ai/threats/cve-2026-23527-h3js-h3-http-request-smuggling-in-readrawbody)