CVE-2026-86252

Name of the Vulnerable Software and Affected Versions h3 versions prior to 1.15.9

Description The software fails to sanitize carriage return characters within EventStream data and comment fields. This allows attackers to inject arbitrary Server-Sent Events (SSE), which are a standard for pushing real-time updates from a server to a browser. By including unsanitized carriage returns, attackers can inject event type directives, split single push calls into multiple events parsed by the browser, or escape comment fields to inject data, bypassing previous fixes that only addressed newline injection.

Recommendations Update h3 to version 1.15.9 or later.