CVE-2026-86251 h3 before 1.15.9 Path Traversal via Double Decoding
Attackers can read arbitrary files from backend storage via double-encoded path traversal in the h3 serveStatic utility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86251?
CVE-2026-86251 is a high-severity path traversal vulnerability in h3js h3, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.
Weakness: CWE-22
Which versions are affected by CVE-2026-86251?
2 open source packages ship an affected version, including h3.
| Package | Affected | Fixed in |
|---|---|---|
h3 npm | All versions | 1.15.9 |
h3 npm | All versions | 1.15.9 |
How do I fix CVE-2026-86251?
Upgrade h3 to 1.15.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-86251 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86251 exists.
Sources
Also known as GHSA-676v-2c25-vqpj, GHSA-72gr-qfp7-vwhw.