h3js h3 up to 1.15.5/2.0.1-rc.14 Static File Serving serveStatic path traversal

Summaryinfo

A vulnerability was found in h3js h3 up to 1.15.5/2.0.1-rc.14. It has been declared as problematic. This affects the function serveStatic of the component Static File Serving. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-86253. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in h3js h3 up to 1.15.5/2.0.1-rc.14. This vulnerability affects the function serveStatic of the component Static File Serving. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-86253 since 09/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 1.15.6 or 2.0.1-rc.15 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-72109). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• h3js

Name

• h3

Version

• 1.15.0
• 1.15.1
• 1.15.2
• 1.15.3
• 1.15.4
• 1.15.5
• 2.0.1-rc.0
• 2.0.1-rc.1
• 2.0.1-rc.2
• 2.0.1-rc.3
• 2.0.1-rc.4
• 2.0.1-rc.5
• 2.0.1-rc.6
• 2.0.1-rc.7
• 2.0.1-rc.8
• 2.0.1-rc.9
• 2.0.1-rc.10
• 2.0.1-rc.11
• 2.0.1-rc.12
• 2.0.1-rc.13
• 2.0.1-rc.14

Website

• Product: https://github.com/h3js/h3/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion