CVE-2026-86253 — h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encode…
Published: 2026-09-06 · CVSS: 8.2 · CVSS 4.0
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7