CVE-2026-86251 in h3js
Summary
by MITRE • 09/06/2026
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The h3 framework, a popular HTTP utility library for Node.js environments, contains a critical security flaw in its serveStatic middleware component prior to version 1.15.9. This vulnerability stems from an improper handling of URL-encoded characters during path resolution, specifically involving double-decoding mechanisms that fail to sanitize input correctly before file system access operations are performed. The core issue lies within the resolveDotSegments function, which is responsible for normalizing paths by removing redundant segments such as current directory references. However, this normalization routine only checks for literal dot characters and does not account for percent-encoded representations of those dots. Consequently, an attacker can exploit this gap by submitting a request path that contains double-encoded sequences representing parent directory traversal markers.
When a malicious payload containing double-encoded dot sequences, such as %252e%252e, is processed by the vulnerable middleware, it undergoes decoding steps that transform the input into single-encoded percent signs followed by dots, resulting in %2e%2e. Because the resolveDotSegments function operates on literal string matching for standard period characters, it fails to recognize these encoded sequences as dangerous path traversal indicators and allows them to pass through unchanged. This oversight creates a significant discrepancy between how the application logic interprets the path and how downstream URL-based backends interpret it. The middleware effectively strips away one layer of encoding but leaves another intact, creating an inconsistency that can be leveraged by attackers to bypass security controls designed to prevent directory traversal attacks.
The operational impact becomes severe when the resolved asset ID is passed to backend services such as Content Delivery Networks (CDNs), Amazon S3 buckets, or other object storage systems. These backends typically adhere strictly to RFC 3986 standards for URI syntax interpretation. Under these standards, percent-encoded characters are decoded during transmission and processing phases. Therefore, when the server sends a request containing %2e%2e to an S3 backend, that backend decodes it into literal dot-dot sequences (..). This final decoding step allows the attacker to traverse up the directory hierarchy on the remote storage system, potentially accessing sensitive configuration files, source code, or other restricted resources that were intended to remain inaccessible. This mechanism effectively turns a local path traversal attempt into a successful arbitrary file read operation against cloud infrastructure components connected to the application.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection in contexts where input leads to unintended system interactions, though it is more accurately categorized under CWE-22 Path Traversal: '..' Sequence. The attack vector corresponds to ATT&CK technique T1530 Data from Cloud Storage Object Discovery, as the exploitation involves navigating cloud storage structures to locate and retrieve unauthorized data objects. Security researchers have identified this pattern in various web frameworks where middleware layers handle URL decoding inconsistently with backend protocols, highlighting a common architectural weakness in modern server-side applications that rely on external storage services for static asset delivery.
To mitigate this vulnerability, organizations running h3 versions prior to 1.15.9 must upgrade immediately to the patched version which corrects the resolveDotSegments logic to properly detect and neutralize encoded traversal sequences. In addition to upgrading, developers should implement strict input validation that rejects any path segments containing percent-encoded special characters before they are processed by static file serving routines. It is also advisable to enforce allow-listing of permitted directories rather than relying solely on blacklist-based filtering mechanisms which can be bypassed through encoding variations. Furthermore, backend configurations for CDNs and object storage should restrict access permissions to the minimum necessary scope, ensuring that even if a traversal attempt succeeds at the application layer, the underlying data remains protected by robust identity and access management policies. Regular security audits focusing on URL decoding logic across middleware chains are essential to prevent similar bypasses in other components of the stack.