CVE-2026-33129

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33129
H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/h3js/h3/pull/1283 Issue Tracking
https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9 Patch
https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*
History

20 Mar 2026, 19:58

Type Values Removed Values Added
First Time H3 h3
H3
CPE cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*
References () https://github.com/h3js/h3/pull/1283 - () https://github.com/h3js/h3/pull/1283 - Issue Tracking
References () https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9 - () https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9 - Patch
References () https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh - () https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh - Exploit, Vendor Advisory
Summary
  • (es) H3 es un framework H(TTP) mínimo. Las versiones 2.0.1-beta.0 hasta la 2.0.0-rc.8 contienen una vulnerabilidad de canal lateral de tiempo en la función requireBasicAuth debido al uso de una comparación de cadenas insegura (!==). Esto permite a un atacante deducir la contraseña válida carácter por carácter midiendo el tiempo de respuesta del servidor, eludiendo eficazmente las protecciones de complejidad de la contraseña. Este problema está solucionado en la versión 2.0.1-rc.9.

20 Mar 2026, 10:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 10:16

Updated : 2026-03-20 19:58

NVD link : CVE-2026-33129

Mitre link : CVE-2026-33129

CVE.ORG link : CVE-2026-33129

JSON object : View

Products Affected

h3

  • h3
CWE
CWE-208

Observable Timing Discrepancy