Is CVE-2026-33129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33129 being exploited in the wild.

How severe is CVE-2026-33129?

Low severity, with a CVSS score of 3.1, published 18 March 2026.

Which products and versions are affected?

h3 (npm) SEMVER:introduced=2.0.0-beta.0,fixed=2.0.1-rc.9; Uber H3-Js >= 2.0.1-beta.0, <= 2.0.0-rc.8.

Is there a fix for CVE-2026-33129?

Yes. h3 (npm): upgrade to 2.0.1-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33129 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33129?

Check whether you run h3 (npm) or Uber H3-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33129: h3 timing side-channel in basic auth validation

Q: Is there a fix for CVE-2026-33129?

Yes. h3 (npm): upgrade to 2.0.1-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33129 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33129?

Check whether you run h3 (npm) or Uber H3-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33129 · Severity: low · CVSS 3.1 · Published 2026-03-18

h3 is a lightweight HTTP framework used to build web services and APIs. The framework's basic authentication function uses an unsafe string comparison that leaks timing information, allowing attackers to guess valid passwords one character at a time by measuring response times. This is particularly effective in cloud or local network environments, converting password cracking from an exponential problem to a linear one.

Technologies: h3 (npm), Uber H3-Js. Vendors: npm, Uber.

Quick answers

Is CVE-2026-33129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33129 being exploited in the wild.
How severe is CVE-2026-33129?: Low severity, with a CVSS score of 3.1, published 18 March 2026.
Which products and versions are affected?: h3 (npm) SEMVER:introduced=2.0.0-beta.0,fixed=2.0.1-rc.9; Uber H3-Js >= 2.0.1-beta.0, <= 2.0.0-rc.8.
Is there a fix for CVE-2026-33129?: Yes. h3 (npm): upgrade to 2.0.1-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33129 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33129?: Check whether you run h3 (npm) or Uber H3-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

h3 (npm): upgrade to 2.0.1-rc.9 or later
```
npm install h3@2.0.1-rc.9
```

Technical details

A timing side-channel vulnerability exists in h3's requireBasicAuth function due to use of the standard !== operator for password comparison. The vulnerable code performs direct string comparison: if (opts.password && password !== opts.password). In V8 and most JavaScript runtimes, !== is optimized to "fail fast"—it stops and returns false as soon as the first mismatched byte is encountered, causing varying execution times based on where the first character mismatch occurs. An attacker can statistically measure these timing differences over multiple requests to deduce the correct password one character at a time, reducing complexity from exponential (guessing the entire string) to linear (guessing one character per attempt). This is feasible remotely in low-latency environments (co-located cloud instances, local networks) and highly effective despite network jitter. The fix (available in v2.0.1-rc.9 and later) implements constant-time string comparison and timing jitter to prevent this disclosure. Affected versions: h3 v2.0.0-beta.0 through v2.0.0-rc.8.

Affected products

h3js h3 >=v2.0.0-beta.0, <=v2.0.0-rc.8

Identifiers

CVE-2026-33129
GHSA-26f5-8h2x-34xh

Timeline

2026-03-18: disclosed: GHSA-26f5-8h2x-34xh published
2026-01-19: patched: Patch released in v2.0.1-rc.9 with constant-time comparison and timing jitter

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.