CVE-2026-86251: h3 serveStatic Path Traversal Vulnerability

CVE-2026-86251 Overview

CVE-2026-86251 is a path traversal vulnerability in the h3 HTTP framework, affecting all versions before 1.15.9. The flaw resides in the serveStatic utility, which performs URL decoding in a way that lets attackers smuggle .. sequences past its dot-segment sanitization. Requests containing double-encoded dot sequences such as %252e%252e are normalized to %2e%2e, which the sanitizer treats as opaque characters. When the resulting asset identifier is passed to a URL-based backend such as a Content Delivery Network (CDN), Amazon S3, or another object store, the backend interprets %2e%2e as .. under RFC 3986, enabling arbitrary file reads from the backing store.

Critical Impact
Unauthenticated attackers can read arbitrary files from URL-based storage backends served through h3 applications running affected versions.

Affected Products

h3 HTTP framework versions before 1.15.9
Applications using h3's serveStatic utility with URL-based backends (CDN, S3, object storage)
Downstream frameworks and services that embed vulnerable h3 releases

Discovery Timeline

2026-09-06 - CVE-2026-86251 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86251

Vulnerability Analysis

The h3 framework exposes a serveStatic helper that resolves incoming request paths to asset identifiers before handing them to a storage backend. To prevent directory traversal, serveStatic calls resolveDotSegments(), which strips . and .. components from the path. The check only inspects literal dot characters after a single URL-decoding pass.

An attacker who submits a path such as /assets/%252e%252e/%252e%252e/etc/passwd triggers one decoding cycle inside h3. The path becomes /assets/%2e%2e/%2e%2e/etc/passwd. resolveDotSegments() sees no literal dots and lets the value through unchanged. The sanitized path is then forwarded to the storage driver.

URL-based backends decode percent-encoded octets a second time per RFC 3986. The %2e%2e sequences resolve to .., and the backend walks out of the intended asset directory. This yields read access to files that the application never intended to expose. The issue is cataloged under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is a decoding-versus-validation mismatch. resolveDotSegments() validates the path after only one decode pass, while downstream URL-based backends perform an additional decode. Any encoding layer that survives the first pass is honored by the second, defeating the sanitizer.

Attack Vector

Exploitation requires only an HTTP request to a public endpoint served by serveStatic. No authentication or user interaction is required. The attacker crafts a request path containing double-encoded dot sequences targeting files stored alongside or above the asset prefix in the backend bucket or CDN origin.

Refer to the GitHub Security Advisory GHSA-72gr-qfp7-vwhw and the VulnCheck Advisory on Path Traversal for advisory details.

Detection Methods for CVE-2026-86251

Indicators of Compromise

HTTP request paths containing double-encoded dot sequences such as %252e%252e, %252E%252E, or mixed-case variants targeting serveStatic routes.
Backend storage access logs (S3, CDN) showing GET requests with resolved .. segments outside the configured asset prefix.
Application logs recording successful serveStatic responses for asset IDs that fall outside the expected directory.

Detection Strategies

Inspect web server and reverse proxy access logs for percent-encoded percent signs (%25) followed by encoded dot sequences.
Correlate h3 application requests with backend object-store GetObject events to flag reads outside the published asset prefix.
Add web application firewall (WAF) rules that normalize the path through multiple decode passes and block traversal attempts.

Monitoring Recommendations

Enable verbose access logging on CDN and object-storage backends and forward events to a centralized analytics platform.
Alert on any successful retrieval of sensitive filenames such as .env, id_rsa, or config.json from asset buckets.
Track the deployed h3 version across services and flag environments still running releases below 1.15.9.

How to Mitigate CVE-2026-86251

Immediate Actions Required

Upgrade h3 to version 1.15.9 or later across all affected services and rebuild dependent artifacts.
Audit backend storage buckets and CDN origins for objects that should not be reachable through serveStatic.
Rotate any credentials, tokens, or secrets that may have been exposed through asset backends.

Patch Information

The h3 maintainers addressed the flaw in version 1.15.9 by decoding the request path fully before invoking resolveDotSegments(), ensuring that double-encoded sequences are normalized before validation. Consult the GitHub Security Advisory GHSA-72gr-qfp7-vwhw for the fix commit and release notes.

Workarounds

Place a WAF or reverse proxy in front of the application that rejects paths containing %25 followed by 2e or 2E.
Restrict backend storage credentials used by serveStatic to a narrow prefix with least-privilege Identity and Access Management (IAM) policies.
Disable or replace serveStatic with a custom handler that fully decodes and canonicalizes the path before backend resolution until the upgrade is complete.

bash

# Configuration example: upgrade h3 to a patched release
npm install h3@^1.15.9
# or
pnpm add h3@^1.15.9
# Verify the installed version
npm ls h3