h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Date: 2026-03
Affected: npm/h3, npm/h3
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33128
CWE: CWE-93
CVSS: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)

## Summary `createEventStream` in h3 is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in `formatEventStreamMessage()` and `formatEventStreamComment()`. An attacker who controls any part of an SSE message field (`id`, `event`, `data`, or comment) can inject arbitrary SSE events to connected clients. ## Details The vulnerability exists in `src/utils/internal/event-stream.ts`, lines [170](https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170)-[187](https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L187): ```typescript export function formatEventStreamComment(comment: string): string { return `: ${comment}\n\n`; } export function formatEventStreamMessage(message: EventStreamMessage): string { let result = ""; if (message.id) { result += `id: ${message.id}\n`; } if (message.event) { result += `event: ${message.event}\n`; } if (typeof message.retry === "number" && Number.isInteger(message.retry)) { result += `retry: ${message.retry}\n`; } result += `data: ${message.data}\n\n`; return result; } ``` The SSE protocol (defined in the [WHATWG HTML spec](https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation)) uses newline characters (`\n`) as field delimiters and double newlines (`\n\n`) as event separators. None of the fields (`id`, `event`, `data`, comment)


Mitigations:

Architectural layers (MAESTRO):