CVE-2026-86251 – Path Traversal / Arbitrary File Disclosure – h3 (h3js) before 1.15.9

Summary

CVE-2026-86251 is a path traversal vulnerability in the serveStatic utility of h3 (h3js), a minimal HTTP framework for Node.js/JavaScript. The flaw arises from a double-decoding inconsistency that allows attackers to bypass h3’s dot-segment sanitization and reach files outside the intended static asset directory. The vulnerability affects all h3 versions prior to 1.15.9 and has been assigned a CVSS v4.0 score of 8.2 (High).

Technical details

• Root cause: h3 decodes incoming request paths twice in different places. H3Event decoding (in src/event.ts) escapes %25 sequences before decoding, while serveStatic (in src/utils/static.ts) performs an additional, redundant decodeURI() call.
• Trigger conditions: An attacker sends a double URL-encoded path such as %252e%252e (which decodes to %2e%2e after the first pass, then to .. when decoded a second time downstream). h3’s resolveDotSegments() sanitization function only checks for literal . characters and does not detect percent-encoded dot sequences, so the malicious segment passes validation.
• Attack vector: Network — a remote, unauthenticated attacker crafts an HTTP request with a double-encoded asset path (e.g., http://vulnerable-app/%252e%252e/%252e%252e/etc/passwd) against an application using h3’s serveStatic utility.
• Impact: Applications that construct backend URLs from the decoded asset ID (e.g., new URL(id, baseUrl)) against URL-based backends such as CDNs or S3-compatible object storage will resolve the traversal sequence and serve files outside the intended directory, resulting in unauthorized disclosure of sensitive files. Applications using filesystem-based backends with path.join() are not affected by this specific bypass. The vulnerability impacts confidentiality only; there is no integrity or availability impact.

Affected software

• Vendor/Package: h3js — h3 (npm package pkg:npm/h3)
• Vulnerable versions: All versions ≤ 1.15.8
• Fixed version: 1.15.9 and later

Severity

• CVSS v4.0: 8.2 (High) — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• CVSS v3.1: 5.9 (Medium) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate: Upgrade the h3 package to version 1.15.9 or later, which removes the redundant decodeURI() call in serveStatic and hardens resolveDotSegments() to detect and normalize percent-encoded dot sequences before path validation.
• If immediate patching is not possible:
  • Avoid using serveStatic in combination with URL-based backends (CDNs, S3, or similar object storage) that construct URLs directly from client-supplied asset identifiers.
  • Where feasible, prefer filesystem-based static serving with path.join(), which is not affected by this bypass.
  • Add an additional layer of input validation/normalization (e.g., reject requests containing encoded traversal sequences such as %252e or %2e) at a reverse proxy or WAF in front of applications using vulnerable h3 versions.
  • Audit backend storage access logs for requests containing repeated percent-encoding of dot-slash sequences as an indicator of attempted exploitation.

References

• CVE-2026-86251 CVE Record (CVEProject/cvelistV5)
• GitHub Security Advisory GHSA-72gr-qfp7-vwhw (h3js/h3)
• VulnCheck Advisory: h3 before 1.15.9 Path Traversal via Double Decoding