CVE-2026-86253: high-severity vulnerability in h3js h3
h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.6%
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
h3js · h3Related CVEs — h3js h3
In the same product, most dangerous first.
CVE-2026-23527HIGHh3 v1 has Request Smuggling (TE.TE) issueEPSS 0.6%CVE-2026-33128HIGHh3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsEPSS 0.6%CVE-2026-86250HIGHh3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked CookieEPSS 0.5%CVE-2026-86251HIGHh3 before 1.15.9 Path Traversal via Double DecodingEPSS 0.4%CVE-2026-33131HIGHh3 has a middleware bypass with one gadgetEPSS 0.4%CVE-2026-86252MEDIUMh3 before 1.15.9 SSE Event Injection via Carriage ReturnEPSS 0.4%