CVE-2026-86253 in h3js
Summary
by MITRE • 09/06/2026
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The h3 framework, a popular HTTP utility library for Node.js environments, contains a critical path traversal vulnerability within its serveStatic function in versions up to 2.0.1-rc.14. This flaw stems from an insufficient normalization of the request URL pathname before it is processed by static file serving logic. Specifically, when handling incoming requests, the framework fails to properly sanitize percent-encoded sequences that represent directory traversal characters. An attacker can exploit this oversight by crafting HTTP requests containing encoded dot-dot segments, such as %2e%2e, which are subsequently decoded into ../ sequences without adequate validation against path boundaries. This lack of sanitization allows the application to resolve file paths outside the designated static root directory, effectively bypassing intended access controls and exposing sensitive files that should remain inaccessible to remote users.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core issue lies in the order of operations within the serveStatic middleware; the pathname extracted from event.url.pathname is passed directly through decoding mechanisms like decodeURI without first ensuring that any encoded traversal attempts are neutralized or rejected. In standard web server configurations, path normalization should occur early in the request processing pipeline to ensure that all subsequent file system interactions operate on a validated, canonical path. By allowing raw percent-encoded sequences to influence the final resolved path, h3 creates an opportunity for directory escape attacks where relative paths can traverse upward through the filesystem hierarchy using encoded characters that evade basic string matching checks.
The operational impact of this vulnerability is severe, particularly in deployments serving static assets such as images, stylesheets, or client-side scripts from a public-facing web server. An unauthenticated remote attacker can leverage this flaw to read arbitrary files on the host system where the Node.js application resides. Depending on the configuration and permissions of the running process, this could lead to the exposure of sensitive data including environment variables containing API keys, database credentials, private SSL certificates, or internal source code. In worst-case scenarios involving misconfigured servers with elevated privileges, reading critical system files could provide further footholds for lateral movement within a network infrastructure. This aligns with ATT&CK technique T1083: File and Directory Discovery, as the attacker uses the vulnerability to enumerate and access restricted resources on the target machine.
To mitigate this risk, organizations running affected versions of h3 must immediately upgrade to version 2.0.1-rc.15 or later for major releases, or version 1.15.6 for legacy branches where applicable. These patched versions implement proper path normalization and validation logic that prevents encoded traversal sequences from resolving outside the intended static directory root. In addition to upgrading dependencies, developers should enforce strict input validation on all URL parameters and ensure that file serving mechanisms utilize secure defaults such as chroot jails or containerized environments with restricted filesystem access. Regular security audits of dependency chains are essential to identify similar vulnerabilities in other middleware components that handle user-supplied paths, ensuring a defense-in-depth approach against path traversal attacks across the entire application stack.