The vulnerability in the h3 HTTP framework allows an attacker who can control any part of a Server‑Sent Events (SSE) message field—id, event, data, or comment—to inject arbitrary SSE content into the stream sent to clients. The missing newline sanitization in the formatting functions lets injected characters be interpreted as new events, potentially delivering malicious payloads to browser‑based clients. This flaw is classified as CWE‑93, indicating that input is placed in an HTTP response without proper contextual escaping.

Affects the h3 framework distributed by h3js. All releases before 1.15.6, and releases from 2.0.0 up to 2.0.1‑rc14, are vulnerable. Versions 1.15.6 and 2.0.1‑rc15 or later contain the fix. The vulnerability resides in the SSE implementation used by the framework.

The CVSS score of 7.5 marks it as high severity. The EPSS score is less than 1 % and the issue is not listed in CISA’s KEV catalog, suggesting a low exploitation probability but still realistic. Exploitation can be performed remotely by an attacker who can influence the content of an SSE message—for example, through a malicious upstream data source or crafted request. The impact is limited to clients consuming the SSE stream; compromised clients could execute injected scripts or otherwise be manipulated. Client‑side code has no need for elevated server privileges, making remote exploitation feasible for attackers with network access to the SSE endpoint.