CVE-2026-86253

Name of the Vulnerable Software and Affected Versions h3 (npm package) versions prior to 1.15.6 h3 (npm package) versions prior to 2.0.1-rc.15

Description A path traversal issue exists in the serveStatic() function. In Node.js deployments, the event.url.pathname is not normalized, allowing percent-encoded dot segments (%2e%2e) to be passed to decodeURI() and decoded into ../ sequences without proper sanitization. This allows an unauthenticated remote attacker to send crafted requests to endpoints served by serveStatic() to read arbitrary files located outside the intended static directory.

Recommendations Update h3 (npm package) to version 1.15.6 or later. Update h3 (npm package) to version 2.0.1-rc.15 or later. As a temporary mitigation, restrict access to the serveStatic() function.