Path Traversal Vulnerability in h3 npm Package by h3js

CVE-2026-86253

What is CVE-2026-86253?

The h3 npm package versions up to and including 2.0.1-rc.14 are susceptible to a path traversal flaw within the serveStatic() function. Due to improper normalization of event.url.pathname on Node.js deployments, it allows an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted requests that include percent-encoded dot segments. This misconfiguration leads to the decoding of these segments into ../ sequences, which can potentially expose sensitive files outside the designated static directory. The issue has been addressed in versions 1.15.6 and 2.0.1-rc.15, where appropriate sanitization measures have been implemented.

References