CVE-2026-86251: h3 before 1.15.9 Path Traversal via Double Decoding
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h3to a version that resolves this vulnerability.Fixed in 1.15.9 - Compensating control
If you use URL-based backends for resolved asset IDs (CDN, S3, object storage), configure their access controls to prevent path traversal from reading arbitrary files when %2e%2e is interpreted as '..' per RFC 3986.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using h3 versions before 1.15.9 and the serveStatic utility are affected when assets are resolved through URL-based backends such as a CDN, S3, or object storage.
What access does an attacker need?
The vulnerability is network-accessible and does not require privileges or user interaction. Exploitation has high attack complexity and relies on supplying a path with double-encoded dot sequences.
What is the likely impact of successful exploitation?
An attacker may traverse outside the intended asset path and read arbitrary files available through the affected backend. The provided impact information indicates confidentiality impact, with no stated integrity or availability impact.