https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:41:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277632 EUVD-2026-277632 https://cve.radiocsirt.org/vuln/euvd-2026-277632 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33490 <p>H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application&#39;s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.</p> <p>H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application&#39;s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags. Version 2.0.2-rc.17 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33490 https://cve.radiocsirt.org/vuln/ghsa-2j6q-whv2-gh6w <p><strong>Affected:</strong> npm: h3</p> <p>## Summary</p> <p>The `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application&#39;s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.</p> <p>## Details</p> <p>The root cause is in `src/h3.ts:127` within the `mount()` method:</p> <p>```typescript // src/h3.ts:122-135 mount(base: string, input: FetchHandler | FetchableObject | H3Type) { if (&#34;handler&#34; in input) { if (input[&#34;~middleware&#34;].length &gt; 0) { this[&#34;~middleware&#34;].push((event, next) =&gt; { const originalPathname = event.url.pathname; if (!originalPathname.startsWith(base)) { // &lt;-- BUG: no segment boundary check return next(); } event.url.pathname = event.url.pathname.slice(base.length) || &#34;/&#34;; return callMiddleware(event, input[&#34;~middleware&#34;], () =&gt; { event.url.pathname = originalPathname; return next(); }); }); } ```</p> <p>When a sub-app is mounted at `/admin`, the check `originalPathname.startsWith(&#34;/admin&#34;)` returns `true` for `/admin`, `/admin/`, `/admin/dashboard`, b…</p> <p><strong>Affected:</strong> npm: h3</p> <p>## Summary</p> <p>The `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application&#39;s path prefix. Because this check does not verify a path segment boundary (i.e., that the next character after the base is `/` or end-of-string), middleware registered on a mount like `/admin` will also execute for unrelated routes such as `/admin-public`, `/administrator`, or `/adminstuff`. This allows an attacker to trigger context-setting middleware on paths it was never intended to cover, potentially polluting request context with unintended privilege flags.</p> <p>## Details</p> <p>The root cause is in `src/h3.ts:127` within the `mount()` method:</p> <p>```typescript // src/h3.ts:122-135 mount(base: string, input: FetchHandler | FetchableObject | H3Type) { if (&#34;handler&#34; in input) { if (input[&#34;~middleware&#34;].length &gt; 0) { this[&#34;~middleware&#34;].push((event, next) =&gt; { const originalPathname = event.url.pathname; if (!originalPathname.startsWith(base)) { // &lt;-- BUG: no segment boundary check return next(); } event.url.pathname = event.url.pathname.slice(base.length) || &#34;/&#34;; return callMiddleware(event, input[&#34;~middleware&#34;], () =&gt; { event.url.pathname = originalPathname; return next(); }); }); } ```</p> <p>When a sub-app is mounted at `/admin`, the check `originalPathname.startsWith(&#34;/admin&#34;)` returns `true` for `/admin`, `/admin/`, `/admin/dashboard`, b…</p> https://cve.radiocsirt.org/vuln/ghsa-2j6q-whv2-gh6w