Vulnerabilities

TI-2026-59039 CVE-2026-86253 · GHSA-jh84-7pcc-38gf

h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

LOW 37

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic().

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00618 Published 2026-09-06 Partial fix · 1.15.6, 2.0.1-rc.15 CWE-22

TI-2026-59038 CVE-2026-86252 · GHSA-jqj6-8hxr-7wwq

h3 before 1.15.9 SSE Event Injection via Carriage Return

HIGH 70

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0036 Published 2026-09-06 Partial fix · 1.15.9, 2.0.1-rc.17 CWE-74

TI-2026-59037 CVE-2026-86251 · GHSA-676v-2c25-vqpj

h3 before 1.15.9 Path Traversal via Double Decoding

HIGH 69

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00428 Published 2026-09-06 Partial fix · 1.15.9 CWE-22

TI-2026-59036 CVE-2026-86250 · GHSA-q5pr-72pq-83v3

h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

MEDIUM 44

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00488 Published 2026-09-06 Fixed in 2.0.1-rc.18 CWE-400

TI-2026-58994 CVE-2026-86205 · GHSA-vhx4-2r84-67h4

h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

MEDIUM 57

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00271 Published 2026-09-06 Partial fix · 2.0.1-rc.18 CWE-601

TI-2026-26111 CVE-2026-33732 · GHSA-p36q-q72m-gchr

srvx is vulnerable to middleware bypass via absolute URI in request line

LOW 28

srvx is a universal server based on web standards.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00255 Published 2026-03-26 Fixed in 0.11.13 CWE-706

TI-2026-25886 CVE-2026-33490 · GHSA-2j6q-whv2-gh6w

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

MEDIUM 57

H3 is a minimal H(TTP) framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00248 Published 2026-03-26 Fixed in 2.0.1-rc.17 CWE-706

TI-2026-25562 CVE-2026-33131 · GHSA-3vj8-jmxq-cgj5

h3 has a middleware bypass with one gadget

HIGH 74

H3 is a minimal H(TTP) framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00404 Published 2026-03-20 Fixed in 2.0.1-rc.15 CWE-290

TI-2026-25560 CVE-2026-33129 · GHSA-26f5-8h2x-34xh

h3 has an observable timing discrepancy in basic auth utils

MEDIUM 60

H3 is a minimal H(TTP) framework.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00332 Published 2026-03-20 Fixed in 2.0.1-rc.9 CWE-208

TI-2026-25559 CVE-2026-33128 · GHSA-22cc-p3c6-wpvm

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

HIGH 76

H3 is a minimal H(TTP) framework.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00596 Published 2026-03-20 Fixed in 2.0.1-rc.15, 1.15.6 CWE-93

TI-2026-18951 CVE-2026-23527 · GHSA-mp2g-9vg9-f4cg

h3 v1 has Request Smuggling (TE.TE) issue

MEDIUM 44

H3 is a minimal H(TTP) framework built for high performance and portability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00626 Published 2026-01-15 Fixed in 1.15.5 CWE-444

Vulnerabilities

Filters