CVE-2026-86253: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h3to a version that resolves this vulnerability.Fixed in 1.15.6 - Upgrade
Upgrade
h3to a version that resolves this vulnerability.Fixed in 2.0.1-rc.15 - Compensating control
On affected Node.js deployments, ensure request URL path normalization before calling serveStatic()/handling event.url.pathname so percent-encoded dot segments (e.g., %2e%2e) cannot be decoded into ../ path traversal sequences.
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js deployments using h3's serveStatic() are exposed when running an affected h3 version. The issue affects versions up to 2.0.1-rc.14; fixes are available in 1.15.6 and 2.0.1-rc.15.
What does an attacker need to exploit this issue?
An attacker needs network access to an endpoint served by serveStatic() and must send a crafted request containing percent-encoded dot segments such as %2e%2e. Authentication and user interaction are not required.
What can an attacker access if exploitation succeeds?
A successful attacker can read arbitrary files outside the intended static directory. The provided information does not indicate integrity or availability impact.