The vulnerability is a host header spoofing flaw in the NodeRequestUrl component of the H3 framework that allows an attacker to craft a Host header to cause the middleware path check to fail while the route handler still processes the request. This permits the bypass of authentication or authorization checks implemented in middleware, resulting in unauthorized access to protected routes. The weakness is classified as CWE‑290. No execution of arbitrary code is possible, but the effect is a privilege escalation within the application.

Vulnerable versions of the H3 JavaScript framework from 2.0.0‑0 through 2.0.1‑rc.14 affect any Node.js application that uses event.url properties in middleware, including frameworks built on H3 such as Nitro or Nuxt. The affected artifacts are listed by CPE as h3 h3 2.0.0 to 2.0.1‑rc.14 for Node JavaScript.

The CVSS base score is 7.4, indicating high severity. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not in the CISA KEV catalog. An attacker must control the Host header of an HTTP request which is typically achievable when the target is exposed to arbitrary clients, such as a public web server. The vulnerability can be exploited by sending a request with a crafted Host header that includes a path component; the framework will then process the route handler but skip the middleware guard, allowing unauthorized access.