H3, a minimal HTTP framework, contains a timing side‑channel in its basic authentication function caused by the use of an unsafe string comparison (!==). The vulnerability allows an attacker to measure the server’s response time for successive password attempts and deduce each password character one at a time, effectively bypassing password complexity protections and exposing the credentials.

The vulnerable H3 library (h3js:h3) is affected in versions 2.0.1-beta.0 through 2.0.0-rc.8. The issue is fixed in version 2.0.1-rc.9 and later. These versions run in Node.js environments.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. An attacker would need remote network access to an HTTP server that uses H3 basic authentication; by repeatedly sending credential guesses and monitoring response times, they could recover valid passwords character by character. The attack requires no special privileges and relies solely on measurable timing differences.