H3Js
Monthly
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files outside the configured static root directory. The root cause is that h3 uses srvx's FastURL class, which skips WHATWG URL normalization for performance - percent-encoded dot segments (%2e%2e) survive raw into decodeURI(), are decoded to ../, and are passed unsanitized to filesystem callbacks. A detailed proof-of-concept exploit chain is publicly documented in GHSA-wr4h-v87w-p3r7; no active exploitation confirmed in CISA KEV at time of analysis. Fixed in versions 1.15.6 and 2.0.1-rc.15.
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arbitrary files from URL-based storage backends (S3, CDN, object storage) by exploiting a double-decoding flaw that bypasses dot-segment normalization. A request crafted with double-encoded dot sequences (%252e%252e) survives the resolveDotSegments() guard - which only matches literal '.' characters - and is then interpreted as '..' by RFC 3986-compliant URL backends. No public exploit code or active exploitation has been confirmed, though the GHSA advisory provides source-level analysis sufficient to guide exploit development.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2.0.1-rc.17 beta) allows remote attackers to inject arbitrary Server-Sent Events by embedding carriage return (`\r`) characters in `data` or `comment` fields that are reflected into the EventStream. Because the HTML SSE specification treats `\r` as a valid line terminator, browsers parse injected `\r` sequences as field boundaries - enabling attackers to spoof event types, split a single push call into multiple distinct browser-parsed events, or escape comment fields to deliver fake data. This is a confirmed incomplete-fix bypass: the prior commit `7791538` sanitized `\n` and `\r` only for `id` and `event` fields while leaving `data` and `comment` unprotected. No public exploit has been confirmed in CISA KEV; however, the GHSA advisory (GHSA-4hxc-9384-m385) includes a proof-of-concept server setup demonstrating the bypass.
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary external domains by crafting a Referer header containing a same-origin URL with a double-slash path segment (e.g., http://target.com//evil.com/phish). The redirectBack() utility passes the WHATWG origin check - because the parsed origin is correctly identified as the target domain - but emits the raw pathname //evil.com/phish as the Location header, which browsers interpret as a protocol-relative redirect to an attacker-controlled site. A proof-of-concept is included in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files outside the configured static root directory. The root cause is that h3 uses srvx's FastURL class, which skips WHATWG URL normalization for performance - percent-encoded dot segments (%2e%2e) survive raw into decodeURI(), are decoded to ../, and are passed unsanitized to filesystem callbacks. A detailed proof-of-concept exploit chain is publicly documented in GHSA-wr4h-v87w-p3r7; no active exploitation confirmed in CISA KEV at time of analysis. Fixed in versions 1.15.6 and 2.0.1-rc.15.
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arbitrary files from URL-based storage backends (S3, CDN, object storage) by exploiting a double-decoding flaw that bypasses dot-segment normalization. A request crafted with double-encoded dot sequences (%252e%252e) survives the resolveDotSegments() guard - which only matches literal '.' characters - and is then interpreted as '..' by RFC 3986-compliant URL backends. No public exploit code or active exploitation has been confirmed, though the GHSA advisory provides source-level analysis sufficient to guide exploit development.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2.0.1-rc.17 beta) allows remote attackers to inject arbitrary Server-Sent Events by embedding carriage return (`\r`) characters in `data` or `comment` fields that are reflected into the EventStream. Because the HTML SSE specification treats `\r` as a valid line terminator, browsers parse injected `\r` sequences as field boundaries - enabling attackers to spoof event types, split a single push call into multiple distinct browser-parsed events, or escape comment fields to deliver fake data. This is a confirmed incomplete-fix bypass: the prior commit `7791538` sanitized `\n` and `\r` only for `id` and `event` fields while leaving `data` and `comment` unprotected. No public exploit has been confirmed in CISA KEV; however, the GHSA advisory (GHSA-4hxc-9384-m385) includes a proof-of-concept server setup demonstrating the bypass.
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary external domains by crafting a Referer header containing a same-origin URL with a double-slash path segment (e.g., http://target.com//evil.com/phish). The redirectBack() utility passes the WHATWG origin check - because the parsed origin is correctly identified as the target domain - but emits the raw pathname //evil.com/phish as the Location header, which browsers interpret as a protocol-relative redirect to an attacker-controlled site. A proof-of-concept is included in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.