CVE-2026-86250: h3 Library DOS Vulnerability

CVE-2026-86250 is a denial of service vulnerability in h3 library versions before 2.0.1-rc.18 caused by improper validation of cookie chunk counts. Attackers can exploit this to hang server processes. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-86250 Overview

CVE-2026-86250 is a denial-of-service vulnerability in the h3 HTTP server framework affecting versions before 2.0.1-rc.18. The flaw resides in the setChunkedCookie() and deleteChunkedCookie() functions, which fail to validate the chunk count parsed from user-controlled cookie values. An unauthenticated remote attacker can send a crafted Cookie header declaring an extremely large chunk count. This triggers an O(n²) cleanup loop that hangs the server process and prevents legitimate request handling.

Critical Impact
A single unauthenticated HTTP request with a malformed chunked cookie can stall an h3-based server, producing a full availability outage without any authentication or user interaction.

Affected Products

h3 JavaScript HTTP server framework
All h3 versions prior to 2.0.1-rc.18
Applications and frameworks embedding vulnerable h3 releases as a dependency

Discovery Timeline

2026-09-06 - CVE-2026-86250 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86250

Vulnerability Analysis

The h3 framework supports chunked cookies, splitting large cookie values across multiple named cookies with a numeric chunk suffix. The helper functions setChunkedCookie() and deleteChunkedCookie() iterate over chunks based on a count derived from incoming cookie headers. Because the parsed chunk count is not bounded, an attacker controls the number of loop iterations.

The cleanup path executes work per chunk in a nested manner, producing quadratic time complexity relative to the attacker-supplied value. Submitting a cookie header that advertises a very large chunk count forces the Node.js event loop to spend seconds or longer inside a single synchronous routine. Because Node processes requests on a single main thread, the entire server stops responding while the loop runs. This aligns with CWE-400: Uncontrolled Resource Consumption.

Root Cause

The root cause is missing input validation on a numeric field that governs loop bounds. Neither setChunkedCookie() nor deleteChunkedCookie() enforces a maximum chunk count before iterating. Trusting attacker-controlled cookie metadata converts routine cookie housekeeping into an algorithmic complexity attack.

Attack Vector

The attack requires only network reachability to a vulnerable h3 endpoint. An attacker sends an HTTP request containing a Cookie header crafted to indicate a very large number of chunks. When h3 invokes the affected helpers during request or response processing, the O(n²) loop executes and blocks the event loop. Repeated requests amplify the outage across worker instances.

Refer to the GitHub Security Advisory GHSA-q5pr-72pq-83v3 and the VulnCheck Advisory for DoS Vulnerability for additional technical detail. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2026-86250

Indicators of Compromise

Inbound HTTP requests carrying Cookie headers with unusually high numeric chunk suffixes or repeated chunked cookie names.
Node.js processes hosting h3 showing sustained 100% CPU on a single core with a stalled event loop.
Sudden increase in request timeouts, upstream 502/504 errors, or health-check failures on h3-backed services.

Detection Strategies

Inspect web server, reverse proxy, and WAF logs for Cookie headers exceeding reasonable size or containing large chunked-cookie indices.
Correlate application latency spikes with specific source IPs sending malformed cookie headers.
Enable Node.js event-loop lag metrics and alert when lag exceeds baseline thresholds during request processing.

Monitoring Recommendations

Track per-request processing time for endpoints that read or write cookies via h3 helpers.
Alert on repeated requests from a single source that trigger long synchronous execution windows.
Forward web-tier logs and Node runtime metrics to a centralized analytics platform to correlate DoS patterns across instances.

How to Mitigate CVE-2026-86250

Immediate Actions Required

Upgrade h3 to version 2.0.1-rc.18 or later across all applications and dependent frameworks.
Audit package.json and lockfiles for direct and transitive h3 dependencies, including framework bundles that vendor h3.
Deploy WAF or reverse-proxy rules that reject requests with oversized Cookie headers or abnormally large chunk indices until patching completes.

Patch Information

The maintainers fixed the issue in h3 2.0.1-rc.18 by validating the chunk count before iterating in setChunkedCookie() and deleteChunkedCookie(). Consult the GitHub Security Advisory GHSA-q5pr-72pq-83v3 for the exact commit and release notes.

Workarounds

Enforce a strict maximum Cookie header length at the reverse proxy or CDN layer.
Drop or sanitize cookies whose names match the chunked-cookie pattern with implausibly high indices before requests reach h3.
Rate-limit unauthenticated requests to endpoints that process cookies, reducing the impact of repeated abusive requests.

bash

# Configuration example
npm install h3@^2.0.1-rc.18
npm ls h3