Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-86253

h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

h3js h3

Default version status: unaffected

  • 0 to < 1.15.6affected
  • 1.15.6unaffected
  • 2.0.0-beta.0 to < 2.0.1-rc.15affected
  • 2.0.1-rc.15unaffected
pkg:npm/h3

References