HTTP Request Smuggling Vulnerability in H3 Framework by h3js

CVE-2026-23527

What is CVE-2026-23527?

The H3 framework, designed for high-performance HTTP applications, is vulnerable to an HTTP Request Smuggling flaw. This arises from a strict case-sensitive check on the Transfer-Encoding header within the readRawBody function, where it only recognizes 'chunked'. According to RFC standards, this header should be treated as case-insensitive, leading to potential exploitation opportunities. The issue has been resolved in version 1.15.5, making it crucial for users to upgrade to this version or later to protect their applications from such vulnerabilities.

References