CVE-2026-86205: h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h3to a version that resolves this vulnerability.Fixed in 2.0.1-rc.18
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must induce a user to interact with a crafted same-origin URL containing a double-slash path segment. The vulnerable application must use redirectBack() with the Referer header, allowing the resulting Location header to be interpreted as a redirect to an external domain.
Are unauthenticated users affected?
Yes. The supplied vector indicates no privileges are required, but user interaction is required.
Which versions need remediation?
h3 versions before 2.0.1-rc.18 are affected. Upgrade to 2.0.1-rc.18 or later.
What is the security impact of a successful exploit?
A successful exploit can redirect a user to an attacker-controlled external domain. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.