Executive brief
h3 is a minimal HTTP framework for building web servers. It includes an EventStream class for Server-Sent Events (SSE), a common technique for real-time updates in chat, notifications, and AI applications. The vulnerability allows attackers who can control user input to inject malicious SSE directives via carriage return characters, enabling event spoofing (redirecting data to unintended handlers), message splitting, or UI manipulation. This is especially dangerous in applications that rely on custom event types for application logic.
Technical details
The vulnerability is an incomplete fix (CWE-74: Improper Neutralization) in the SSE implementation. The formatEventStreamMessage() and formatEventStreamComment() functions split on \n only (via String.split("\n")), but the SSE RFC specifies that \r and \r\n are also valid line terminators. An attacker who controls data or comment fields can inject \r characters to break the intended SSE framing. For example, "legit\revent: evil" is emitted as a single "data:" line but parsed by the browser as two lines due to the \r terminator, causing injection of a custom "evil" event type. The _sanitizeSingleLine() function exists to strip both \r and \n, but it is only applied to the id and event fields, not to data or comment. The fix requires splitting on the regex /\r\n|\r|\n/ instead of just "\n".
Affected products
- h3js h3 0 to 1.15.8, 2.0.0-beta.0 to 2.0.1-rc.16
Timeline
- 2026-03-20: disclosed: GHSA-4hxc-9384-m385 published
- 2026-03-20: patched: Fixed in h3 1.15.9 and 2.0.1-rc.17