CVE-2026-86205

Name of the Vulnerable Software and Affected Versions h3 versions prior to 2.0.1-rc.18

Description The redirectBack() utility fails to sanitize protocol-relative paths within the Referer header pathname. This allows attackers to craft a same-origin URL containing a double-slash path segment that bypasses origin validation. Consequently, the application generates a Location header that browsers interpret as a protocol-relative redirect to an external domain.

Recommendations Update h3 to version 2.0.1-rc.18 or later.