EUVD-2026-72106
GHSA-fg72-q65g-wm5w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single network request with no complexity causes process hang; no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5Blast Radius
ecosystem impact- 12 npm packages depend on h3 (6 direct, 6 indirect)
Ecosystem-wide dependent count for version 2.0.0-beta.4.
DescriptionCVE.org
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
AnalysisAI
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The setChunkedCookie() and deleteChunkedCookie() functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (__chunked__N) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must use h3 sessions - specifically, any endpoint that calls `getSession()` or equivalent session helpers, which internally invoke the chunked-cookie path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) captures the core risk accurately: unauthenticated network-reachable exploitation with no preconditions delivers complete availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to h3 version 2.0.1-rc.18 or later, which introduces upper-bound validation in `getChunkedCookieCount()` to cap the attacker-supplied integer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate action (24 hours): Identify all applications using h3 npm package versions 2.0.0-beta.4 through 2.0.1-rc.17 and audit production, staging, and development environments for affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in H3 framework versions before 1.15.5 allows remote attackers to bypass security controls by exp
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arb
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary e
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today