What’s Vulnerable › Vulnerabilities

CVE-2026-86251: h3 before 1.15.9 Path Traversal via Double Decoding

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-06 · updated 2026-09-09
• Weakness: CWE-22

Description

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.

Affected products

• h3js h3: before 1.15.9 — fixed in 1.15.9

How to fix

Upgrade to a fixed version: h3js h3 1.15.9. Check the vendor advisory for mitigations.

References

• https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw
• https://www.vulncheck.com/advisories/h3-before-1.15.9-path-traversal-via-double-decoding
• https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw

Get alerted when CVE-2026-86251 or the next vulnerability affects your stack