EUVD-2026-72107
GHSA-676v-2c25-vqpj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth or user interaction required, but AC:H for URL-based backend prerequisite and double-encoding craft; strictly read-only impact with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5Blast Radius
ecosystem impact- 7 npm packages depend on h3 (6 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.15.9.
DescriptionCVE.org
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.
AnalysisAI
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arbitrary files from URL-based storage backends (S3, CDN, object storage) by exploiting a double-decoding flaw that bypasses dot-segment normalization. A request crafted with double-encoded dot sequences (%252e%252e) survives the resolveDotSegments() guard - which only matches literal '.' characters - and is then interpreted as '..' by RFC 3986-compliant URL backends. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target application invokes h3's serveStatic utility - applications using only manually defined routes are not affected; (2) the serveStatic backend is URL-based, specifically S3, a CDN, or another object-storage system that performs RFC 3986-compliant URL resolution - local filesystem-backed configurations are NOT vulnerable because OS path resolution does not interpret %2e as '.'; (3) sensitive files must be accessible within the storage namespace reachable by the backend. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.2, reflecting meaningful real-world impact constrained by two concrete prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade h3 to version 1.15.9 or later via npm, yarn, or pnpm - this release removes the redundant decodeURI() call in serveStatic, eliminating the double-decoding flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all services using h3 serveStatic and determine which are running versions before 1.15.9 with URL-based storage backends. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in H3 framework versions before 1.15.5 allows remote attackers to bypass security controls by exp
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote a
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary e
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today