CVE-2026-86251

Name of the Vulnerable Software and Affected Versions h3 versions prior to 1.15.9

Description The serveStatic utility contains a path traversal flaw caused by a double-decoding issue. A request path containing double-encoded dot sequences, such as %252e%252e, is decoded to %2e%2e. This sequence bypasses the resolveDotSegments() function because it only checks for literal '.' characters. When URL-based backends like CDNs, S3, or object storage resolve the resulting asset ID, %2e%2e is interpreted as '..' according to RFC 3986, allowing an attacker to read arbitrary files from the backend.

Recommendations Update h3 to version 1.15.9 or later.