h3

Minimal H(TTP) framework built for high performance and portability.

Latest 2.0.2

74%

Total Score

caution

A mature, frequently released package is held back by missing build attestation and limited verifiable project transparency.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation, trusted publisher, or staged publishing is reported, so consumers cannot verify how this artifact was produced. The package's long and active release history partly offsets, but does not remove, this transparency gap.

Version stability

Version 2.0.2 is a stable major release rather than a prerelease. However, 80% of recent releases were prereleases, which adds some release-process uncertainty.

Vulnerabilities

Title	Versions	Severity
CVE-2026-86250 h3 is vulnerable to Uncontrolled Resource Consumption in versions 2.0.0-beta.4 - 2.0.1-rc.18.	2.0.0-beta.4 - 2.0.1-rc.18	Medium
CVE-2026-33490 h3 is vulnerable to Use of Incorrectly-Resolved Name or Reference in versions 2.0.1-alpha.0 - 2.0.1-rc.16.	2.0.1-alpha.0 - 2.0.1-rc.16	Low
CVE-2026-33131 h3 is vulnerable to Authentication Bypass by Spoofing in versions 2.0.0-0 - 2.0.1-rc.15.	2.0.0-0 - 2.0.1-rc.15	High
CVE-2026-33129 h3 is vulnerable to Observable Timing Discrepancy in versions 2.0.0-beta.0 - 2.0.0-rc.8.	2.0.0-beta.0 - 2.0.0-rc.8	Medium
CVE-2026-33128 h3 is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in versions 2.0.0 - 2.0.1-rc.14 and 0.0.0 - 1.15.6.	0.0.0 - 1.15.62.0.0 - 2.0.1-rc.14	High