h3 versions prior to 1.15.9 do not sanitize carriage return characters in EventStream data and comment fields, permitting attackers to inject arbitrary SSE events. Attackers can insert event type directives, split single push calls into multiple browser‑parsed events, or escape comment fields to introduce new data. The vulnerability extends the scope of a prior newline injection fix by allowing these exploit vectors to work with carriage returns.

The affected product is the h3js h3 JavaScript routing library. Versions earlier than 1.15.9 are vulnerable; the fix is available in release 1.15.9 and later.

The CVSS score of 6.9 indicates moderate severity, and the entry is not listed in CISA’s KEV catalog. EPSS is not available, suggesting limited public exploitation data. Attackers can exploit this weakness by sending specially crafted SSE payloads containing carriage returns to any application that uses the vulnerable h3 library to serve events. The vulnerability requires that the attacker control the SSE input; no privilege escalation is required.