CVE-2026-86252 in h3js
Summary
by MITRE • 09/06/2026
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in h3 versions preceding 1.15.9 represents a significant input validation failure within the HTTP/3 server implementation, specifically concerning the handling of Server-Sent Events and comment fields. This flaw stems from an insufficient sanitization process for carriage return characters embedded within EventStream data structures. In standard web application architectures utilizing Server-Sent Events, clients expect a specific line-based protocol where each message is delimited by double newlines. The failure to properly escape or reject carriage returns allows attackers to manipulate the structural integrity of these event streams, effectively breaking the expected parsing logic that relies on strict adherence to newline-only delimiters for separating distinct events and fields.
From a technical perspective, this vulnerability exploits the ambiguity introduced when carriage return characters are not strictly filtered out during the processing of incoming EventStream payloads. By injecting unsanitized carriage returns into comment fields or data sections, an attacker can artificially terminate lines prematurely or inject new line breaks that were not intended by the application logic. This capability enables several distinct attack vectors including the injection of arbitrary Server-Sent Events directly into the stream sent to downstream clients. Furthermore, attackers can split a single logical push call from the server into multiple discrete events as interpreted by the browser client. This fragmentation allows for potential bypasses of content security policies or input validation rules that might be applied per-event rather than on the aggregate payload, thereby undermining the integrity checks designed to protect against cross-site scripting and other injection-based attacks.
The operational impact of this vulnerability is substantial, particularly in applications relying heavily on real-time data updates via Server-Sent Events for critical functionality such as live dashboards, notifications, or financial feeds. An attacker who successfully exploits this flaw can manipulate the client-side rendering engine by injecting malicious event type directives that trigger unintended JavaScript execution if not properly sanitized downstream. Additionally, the ability to escape comment fields allows an adversary to inject data into active message streams, potentially leading to information disclosure or state manipulation on the client side. This issue is particularly concerning because it represents a regression in security posture relative to previous fixes; earlier patches addressed newline injection vulnerabilities but failed to account for carriage return characters, leaving a residual attack surface that sophisticated attackers can leverage to bypass existing mitigations and achieve code execution or data exfiltration scenarios similar to those seen in classic cross-site scripting attacks.
To mitigate this vulnerability, organizations must immediately upgrade the h3 library to version 1.15.9 or later where these input validation checks have been corrected. In environments where immediate patching is not feasible, implementing a strict allowlist for allowed characters within EventStream data and comment fields at the application layer can provide temporary protection. Developers should ensure that all incoming stream data undergoes rigorous sanitization to strip or escape carriage return characters before they are processed by the server's event emitter logic. Furthermore, security teams should review existing Server-Sent Events implementations to verify that client-side parsers are robust against malformed line endings and consider implementing Content Security Policy headers that restrict script execution from untrusted sources as a defense-in-depth measure. This incident highlights the importance of comprehensive input validation strategies that account for all whitespace characters defined in relevant standards rather than focusing solely on newline sequences, aligning with CWE-20 Improper Input Validation guidelines to prevent injection-based attacks through protocol manipulation.