CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
An unauthenticated remote attacker can read arbitrary files outside the intended static directory via crafted requests in the h3 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86253?
CVE-2026-86253 is a high-severity path traversal vulnerability in h3js h3, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
Weakness: CWE-22
Which versions are affected by CVE-2026-86253?
4 open source packages ship an affected version, including h3.
| Package | Affected | Fixed in |
|---|---|---|
h3 npm | All versions | 1.15.6 |
h3 npm | All versions | 1.15.6 |
h3 npm | From 2.0.0 | 2.0.1-rc.15 |
h3 npm | From 2.0.0 | 2.0.1-rc.15 |
How do I fix CVE-2026-86253?
Upgrade h3 to a fixed version for your release line: 1.15.6 or 2.0.1-rc.15.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-86253 being exploited?
There is no known exploitation of CVE-2026-86253 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1792233034, GHSA-jh84-7pcc-38gf, GHSA-wr4h-v87w-p3r7.