5.9 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
h3 has an observable timing discrepancy in basic auth utils
H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.
References
- https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh x_refsource_CONFIRM
- https://github.com/h3js/h3/pull/1283 x_refsource_MISC
- https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9 x_refsource_MISC
Affected products
- ==>= 2.0.1-beta.0, < 2.0.1-rc.9
Matching in nixpkgs
pkgs.h3
Hexagonal hierarchical geospatial indexing system
pkgs.h3_3
Hexagonal hierarchical geospatial indexing system
pkgs.h3_4
Hexagonal hierarchical geospatial indexing system
pkgs.ch341eeprom
Libusb based programming tool for 24Cxx serial EEPROMs using the WinChipHead CH341A IC
-
nixos-unstable 0-unstable-2024-05-06
- nixpkgs-unstable 0-unstable-2024-05-06
- nixos-unstable-small 0-unstable-2024-05-06
-
nixos-25.11 0-unstable-2024-05-06
- nixos-25.11-small 0-unstable-2024-05-06
- nixpkgs-25.11-darwin 0-unstable-2024-05-06
pkgs.xash3d-fwgs
Xash3D FWGS engine
-
nixos-unstable 0-unstable-2026-02-25
- nixpkgs-unstable 0-unstable-2026-02-25
- nixos-unstable-small 0-unstable-2026-02-25
pkgs.xash-dedicated
Xash3D FWGS engine
-
nixos-unstable 0-unstable-2026-02-25
- nixpkgs-unstable 0-unstable-2026-02-25
- nixos-unstable-small 0-unstable-2026-02-25
pkgs.emiluaPlugins.bech32
Bech32 codec for Emilua
-
nixos-unstable bech32-1.1.1
- nixpkgs-unstable bech32-1.1.1
- nixos-unstable-small bech32-1.1.1
-
nixos-25.11 bech32-1.1.1
- nixos-25.11-small bech32-1.1.1
- nixpkgs-25.11-darwin bech32-1.1.1
pkgs.python312Packages.h3
Hierarchical hexagonal geospatial indexing system
pkgs.python313Packages.h3
Hierarchical hexagonal geospatial indexing system
pkgs.python314Packages.h3
Hierarchical hexagonal geospatial indexing system
pkgs.python312Packages.nh3
Python binding to Ammonia HTML sanitizer Rust crate
-
nixos-25.11 nh3-0.2.21
- nixos-25.11-small nh3-0.2.21
- nixpkgs-25.11-darwin nh3-0.2.21
pkgs.python312Packages.qh3
Lightweight QUIC and HTTP/3 implementation in Python
pkgs.python313Packages.nh3
Python binding to Ammonia HTML sanitizer Rust crate
-
nixos-25.11 nh3-0.2.21
- nixos-25.11-small nh3-0.2.21
- nixpkgs-25.11-darwin nh3-0.2.21
pkgs.python313Packages.qh3
Lightweight QUIC and HTTP/3 implementation in Python
pkgs.python314Packages.nh3
Python binding to Ammonia HTML sanitizer Rust crate
pkgs.python314Packages.qh3
Lightweight QUIC and HTTP/3 implementation in Python
pkgs.tests.fetchurl.header
None
-
nixos-unstable my2saihh3wkp
- nixpkgs-unstable my2saihh3wkp
- nixos-unstable-small my2saihh3wkp
pkgs.python312Packages.mmh3
Python wrapper for MurmurHash3, a set of fast and robust hash functions
-
nixos-25.11 mmh3-5.2.0
- nixos-25.11-small mmh3-5.2.0
- nixpkgs-25.11-darwin mmh3-5.2.0
pkgs.python313Packages.mmh3
Python wrapper for MurmurHash3, a set of fast and robust hash functions
-
nixos-unstable mmh3-5.2.1
- nixpkgs-unstable mmh3-5.2.1
- nixos-unstable-small mmh3-5.2.1
-
nixos-25.11 mmh3-5.2.0
- nixos-25.11-small mmh3-5.2.0
- nixpkgs-25.11-darwin mmh3-5.2.0
pkgs.python314Packages.mmh3
Python wrapper for MurmurHash3, a set of fast and robust hash functions
-
nixos-unstable mmh3-5.2.1
- nixpkgs-unstable mmh3-5.2.1
- nixos-unstable-small mmh3-5.2.1
pkgs.postgresqlPackages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.python312Packages.bech32
None
-
nixos-25.11 bech32-1.2.0
- nixos-25.11-small bech32-1.2.0
- nixpkgs-25.11-darwin bech32-1.2.0
pkgs.python313Packages.bech32
None
-
nixos-unstable bech32-1.2.0
- nixpkgs-unstable bech32-1.2.0
- nixos-unstable-small bech32-1.2.0
-
nixos-25.11 bech32-1.2.0
- nixos-25.11-small bech32-1.2.0
- nixpkgs-25.11-darwin bech32-1.2.0
pkgs.python314Packages.bech32
None
-
nixos-unstable bech32-1.2.0
- nixpkgs-unstable bech32-1.2.0
- nixos-unstable-small bech32-1.2.0
pkgs.postgresql13Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.postgresql14Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.postgresql15Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.postgresql16Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.postgresql17Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.postgresql18Packages.h3-pg
PostgreSQL bindings for H3, a hierarchical hexagonal geospatial indexing system
pkgs.python312Packages.cheetah3
Template engine and code generation tool
-
nixos-25.11 cheetah3-3.4.0
- nixos-25.11-small cheetah3-3.4.0
- nixpkgs-25.11-darwin cheetah3-3.4.0
pkgs.python313Packages.cheetah3
Template engine and code generation tool
-
nixos-unstable cheetah3-3.4.0.post5
- nixpkgs-unstable cheetah3-3.4.0.post5
- nixos-unstable-small cheetah3-3.4.0.post5
-
nixos-25.11 cheetah3-3.4.0
- nixos-25.11-small cheetah3-3.4.0
- nixpkgs-25.11-darwin cheetah3-3.4.0
pkgs.python314Packages.cheetah3
Template engine and code generation tool
-
nixos-unstable cheetah3-3.4.0.post5
- nixpkgs-unstable cheetah3-3.4.0.post5
- nixos-unstable-small cheetah3-3.4.0.post5
pkgs.haskellPackages.ppad-bech32
bech32 and bech32m encoding/decoding, per BIPs 173 & 350
-
nixos-unstable bech32-0.2.4
- nixpkgs-unstable bech32-0.2.4
- nixos-unstable-small bech32-0.2.4
-
nixos-25.11 bech32-0.2.3
- nixos-25.11-small bech32-0.2.3
- nixpkgs-25.11-darwin bech32-0.2.3
pkgs.python312Packages.pytorch3d
FAIR's library of reusable components for deep learning with 3D data
-
nixos-25.11 pytorch3d-0.7.8
- nixos-25.11-small pytorch3d-0.7.8
- nixpkgs-25.11-darwin pytorch3d-0.7.8
pkgs.python313Packages.pytorch3d
FAIR's library of reusable components for deep learning with 3D data
-
nixos-unstable pytorch3d-0.7.9
- nixpkgs-unstable pytorch3d-0.7.9
- nixos-unstable-small pytorch3d-0.7.9
-
nixos-25.11 pytorch3d-0.7.8
- nixos-25.11-small pytorch3d-0.7.8
- nixpkgs-25.11-darwin pytorch3d-0.7.8
pkgs.python314Packages.pytorch3d
FAIR's library of reusable components for deep learning with 3D data
-
nixos-unstable pytorch3d-0.7.9
- nixpkgs-unstable pytorch3d-0.7.9
- nixos-unstable-small pytorch3d-0.7.9
pkgs.tests.fetchgit.withGitConfig
None
-
nixos-unstable qf4mrhl0nh3n
- nixpkgs-unstable qf4mrhl0nh3n
- nixos-unstable-small qf4mrhl0nh3n
pkgs.tests.fetchFirefoxAddon.simple
None
-
nixos-25.11 lx7h38hzpwkh
- nixos-25.11-small lx7h38hzpwkh
- nixpkgs-25.11-darwin lx7h38hzpwkh
pkgs.tests.fetchpatch.fileWithSpace
None
-
nixos-unstable 6h3cn3ysasv1
- nixpkgs-unstable 6h3cn3ysasv1
- nixos-unstable-small 6h3cn3ysasv1
pkgs.tests.fetchFromGitHub.fetchTags
None
-
nixos-25.11 2yh3xarjjdx3
- nixos-25.11-small 2yh3xarjjdx3
- nixpkgs-25.11-darwin 2yh3xarjjdx3
pkgs.pkgsRocm.python3Packages.pytorch3d
FAIR's library of reusable components for deep learning with 3D data
-
nixos-unstable pytorch3d-0.7.9
- nixpkgs-unstable pytorch3d-0.7.9
- nixos-unstable-small pytorch3d-0.7.9
-
nixos-25.11 pytorch3d-0.7.8
- nixos-25.11-small pytorch3d-0.7.8
- nixpkgs-25.11-darwin pytorch3d-0.7.8
pkgs.tests.prefer-remote-fetch.fetchurl
None
-
nixos-25.11 2jh3zzs3d2nl
- nixos-25.11-small 2jh3zzs3d2nl
- nixpkgs-25.11-darwin 2jh3zzs3d2nl
-
nixos-25.11 lx7h38hzpwkh
- nixos-25.11-small lx7h38hzpwkh
- nixpkgs-25.11-darwin lx7h38hzpwkh
-
nixos-unstable crateBinNoPath3-test
- nixpkgs-unstable crateBinNoPath3-test
- nixos-unstable-small crateBinNoPath3-test
-
nixos-25.11 crateBinNoPath3-test
- nixos-25.11-small crateBinNoPath3-test
- nixpkgs-25.11-darwin crateBinNoPath3-test
-
nixos-25.11 h3l03k4wp43v
- nixos-25.11-small h3l03k4wp43v
- nixpkgs-25.11-darwin h3l03k4wp43v
Package maintainers
-
@xokdvium Sergei Zimmerman <sergei@zimmerman.foo>
-
@manipuladordedados Valter Nazianzeno <manipuladordedados@gmail.com>
-
@kalbasit Wael Nasreddine <wael.nasreddine@gmail.com>
-
@pjjw Peter Woodman <peter@shortbus.org>
-
@sarahec Sarah Clark <seclark@nextquestion.net>
-
@happysalada Raphael Megzari <raphael@megzari.com>
-
@SomeoneSerge Else Someone <else+nixpkgs@someonex.net>
-
@pbsds Peder Bergebakken Sundt <pbsds@hotmail.com>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@r4v3n6101 r4v3n6101 <raven6107@gmail.com>