h3 has a middleware bypass with one gadget

Vulnerability

Overview

The vulnerability resides in H3's NodeRequestUrl class, which extends FastURL. When properties like event.url, event.url.hostname, or event.url._url are accessed, the _url getter constructs a URL object from this.href, which itself is built from untrusted components including the user-controlled Host header.[1][2] This allows an attacker to inject arbitrary path segments or query parameters into the URL by sending a specially crafted Host header, such as Host: localhost:3000/abchehe?.

Attack

Vector and Exploitation

H3's router resolves the route handler before middleware runs. If middleware accesses event.url properties (e.g., for logging or checking), the malicious Host header causes the constructed URL to appear as a different path than the actual request route.[2] The middleware may check the path and allow the request, while the route handler still matches the intended sensitive endpoint. No authentication is required; the attacker only needs to control the Host header in the HTTP request.

Impact

Successful exploitation allows an attacker to bypass authentication or authorization middleware that relies on URL inspection. This can lead to unauthorized access to sensitive routes, such as /internal/run in the example, where an internal key check is performed but is never reached because the middleware mistakenly passes the request.[2] Any application built on H3, including those using Nitro or Nuxt, that uses event.url in middleware guarding sensitive routes is affected.

Mitigation

The vulnerability is fixed in version 2.0.1-rc.15.[1] Users should upgrade to this version or later. There is no indication of a workaround; immediate patching is recommended.