CVE-2026-33490: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33490 is an authorization bypass vulnerability in the h3 HTTP framework (npm package) caused by a missing path segment boundary check in the mount() method. Middleware registered on a mounted sub-application incorrectly executes for any route whose path string-prefix-matches the mount base, not just routes under the intended path segment tree. This affects h3 versions >= 2.0.1-alpha.0 through <= 2.0.1-rc.16 for Node.js. The vulnerability was published on March 20, 2026, and patched in version 2.0.1-rc.17. The CVSS v3.1 base score is 3.7 (Low) per the GitHub Advisory, though Feedly estimates it as High (5.3) under a different vector assumption (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-706: Use of Incorrectly-Resolved Name or Reference) lies in src/h3.ts:127 within the mount() method, which uses a bare startsWith() check — originalPathname.startsWith(base) — without verifying that the character immediately following the base is / or end-of-string. This means a mount at /admin incorrectly matches /admin-public, /administrator, /adminstuff, etc. A secondary instance of the same flaw exists in src/utils/internal/path.ts:40 within the withoutBase() utility, which produces mangled paths such as /-public/info instead of /admin-public/info. Exploitation requires no authentication or special privileges — an attacker simply sends an HTTP GET request to a path that string-prefix-matches the mount base but routes to a different handler, causing the mounted middleware to set privileged context flags (e.g., isAdmin = true) on the unrelated request. A public proof-of-concept is included in the security advisory (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to trigger privileged context flags (such as isAdmin, isAuthenticated, or role assignments) on requests to routes that were never intended to be covered by the mounted middleware. If application route handlers rely on these middleware-set context values for access control decisions, an attacker can bypass authorization and access protected functionality without valid credentials. The withoutBase() path mangling side effect may additionally cause routing errors or downstream security issues in path processing logic. Confidentiality impact is rated None, with Low integrity impact; availability is unaffected (GitHub Advisory, Feedly).

A standalone proof-of-concept (poc.js) is publicly available within the GitHub Security Advisory, demonstrating context pollution by setting up an h3 application with a mounted admin sub-app and making HTTP requests to show the middleware leak. The PoC is a runnable JavaScript/Bun script requiring no external infrastructure beyond a local server. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.022–0.029%, indicating a low near-term exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications built on h3 v2 (npm package h3, versions >= 2.0.1-alpha.0 through <= 2.0.1-rc.16) that use mount() with a base path (e.g., /admin) and have middleware setting privileged context flags.
2. Identify prefix-matching routes: Enumerate application routes to find paths that string-prefix-match the mount base but are handled by a different (non-admin) handler — e.g., /admin-public, /administrator, /adminstuff.
3. Craft the request: Send a standard HTTP GET request to the prefix-matching route: GET /admin-public/info HTTP/1.1.
4. Trigger middleware execution: The mount() method's startsWith('/admin') check passes for /admin-public/info, causing the admin sub-app's middleware chain to execute and set event.context.isAdmin = true.
5. Access protected functionality: The parent app's /admin-public/info handler (or any other route handler that checks event.context.isAdmin) now sees isAdmin === true, granting the attacker unauthorized access to protected functionality (GitHub Advisory).

• Network: Unusual HTTP requests to paths that share a string prefix with known mount points but are not legitimate sub-app routes (e.g., GET /admin-public/..., GET /administrator/..., GET /adminstuff/... when only /admin/ is a valid mount).
• Logs: Application access logs showing requests to prefix-matching paths (e.g., /admin-public, /administrator) that result in unexpected HTTP 200 responses or access to privileged resources; log entries where middleware execution is recorded for routes outside the intended mount scope.
• Application Behavior: Route handlers returning data or performing actions that should require elevated privileges (e.g., isAdmin: true) for requests to nominally public endpoints.

Upgrade the h3 npm package to version 2.0.1-rc.17 or later, which adds a path segment boundary check after the startsWith() call in both src/h3.ts and src/utils/internal/path.ts. As a temporary workaround, avoid using mount() with base paths that are string prefixes of other application routes (e.g., do not mount at /admin if /admin-public is also a route). Additionally, implement explicit authorization checks within individual route handlers rather than relying solely on middleware-set context flags, so that access control is not defeated by context pollution (GitHub Advisory, Red Hat Bugzilla).