CVE-2026-86252 h3 before 1.15.9 SSE Event Injection via Carriage Return
Attackers can inject arbitrary Server-Sent Events by exploiting unsanitized carriage returns in h3 library data fields.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86252?
CVE-2026-86252 is a medium-severity vulnerability in h3js h3, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
Weakness: CWE-74
Which versions are affected by CVE-2026-86252?
4 open source packages ship an affected version, including h3.
| Package | Affected | Fixed in |
|---|---|---|
h3 npm | All versions | 1.15.9 |
h3 npm | All versions | 1.15.9 |
h3 npm | From 2.0.0-beta.0 | 2.0.1-rc.17 |
h3 npm | From 2.0.0-beta.0 | 2.0.1-rc.17 |
How do I fix CVE-2026-86252?
Upgrade h3 to a fixed version for your release line: 1.15.9 or 2.0.1-rc.17.
Is CVE-2026-86252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86252 exists.
Sources
Also known as GHSA-4hxc-9384-m385, GHSA-jqj6-8hxr-7wwq.