CVE-2026-86253 | BDVDB-2026-368663 Detail

Description#

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-06Record published in the CVE List.
2. Version 22026-09-10Most recent update recorded in the CVE List.