Executive brief
h3 is a minimal HTTP framework used to build web applications. The framework's mount() method, which mounts sub-applications at specific path prefixes, fails to properly validate path boundaries. An attacker can exploit this by requesting URLs that share only a string prefix with a mounted path (e.g., /admin-public when /admin is mounted), causing security middleware intended only for the /admin path to execute on unrelated routes. This could allow unauthorized access to protected functionality if the application relies on middleware to set permission flags.
Technical details
The vulnerability is a path traversal/bypass issue rooted in improper string prefix matching. The mount() method at src/h3.ts:127 and withoutBase() utility at src/utils/internal/path.ts:40 both use startsWith() without checking that the character immediately following the base prefix is a forward slash (/), query string (?), fragment (#), or end-of-string. This causes /admin middleware to incorrectly match /admin-public, /administrator, /adminstuff, etc. A mounted sub-app's middleware chain then executes for these unrelated paths, polluting the request context with privileges it should never have. The attack requires no authentication or user interaction—a simple HTTP GET request to a prefix-matching path triggers the context pollution. A patch adding segment boundary validation is available in version 2.0.1-rc.17 and later.
Affected products
- h3js h3 >=2.0.1-alpha.0 through 2.0.1-rc.16
Timeline
- 2026-03-20: disclosed: Security advisory GHSA-2j6q-whv2-gh6w published
- 2026-03-20: patched: Patch available in h3 >= 2.0.1-rc.17