CVE-2026-86252: h3 EventStream XSS Vulnerability

CVE-2026-86252 Overview

CVE-2026-86252 affects the h3 HTTP server framework in versions prior to 1.15.9. The library fails to sanitize carriage return (\r) characters in Server-Sent Events (SSE) data and comment fields. Attackers can inject arbitrary SSE events by supplying unsanitized carriage returns in user-controlled input. The flaw bypasses a prior CVE fix that only addressed newline (\n) injection. This is classified under [CWE-74] as an improper neutralization of special elements in output used by a downstream component.

Critical Impact
Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject arbitrary SSE data streams.

Affected Products

h3 HTTP framework versions prior to 1.15.9
Applications using h3 EventStream to relay untrusted input to clients
Downstream Nitro and Nuxt-based services depending on vulnerable h3 releases

Discovery Timeline

2026-09-06 - CVE-2026-86252 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86252

Vulnerability Analysis

The h3 framework provides a Server-Sent Events (SSE) helper that constructs event streams for browser clients. SSE messages use a line-based text protocol where fields such as event:, data:, and comment lines (prefixed with :) are separated by newline characters. Browsers treat both line feed (\n) and carriage return (\r) as line terminators when parsing the stream.

An earlier patch neutralized \n characters in EventStream payloads but did not filter \r. Attackers can supply a carriage return inside a data value or a comment and force the browser to interpret subsequent bytes as a new SSE field. This enables injection of event: directives, forged data: payloads, and multiple synthetic events from a single server push.

The impact is limited to integrity of the SSE channel content delivered to clients. Confidentiality and availability of the host are not directly affected, but downstream client applications that trust SSE event types may execute unintended handlers.

Root Cause

The root cause is incomplete input sanitization in the EventStream serialization path. The fix for the prior newline-injection CVE stripped \n but not \r, leaving carriage return as a viable line terminator that browser SSE parsers accept.

Attack Vector

Exploitation requires only that an attacker supply input that reaches an SSE push call as data or comment content. A remote, unauthenticated attacker can trigger the flaw by submitting a value containing \r followed by crafted SSE fields such as event: or data:. The injected content is then delivered to any subscribed browser client. Refer to the GitHub Security Advisory GHSA-4hxc-9384-m385 and the VulnCheck Advisory for h3 Event Injection for protocol-level detail.

Detection Methods for CVE-2026-86252

Indicators of Compromise

Outbound SSE responses containing raw \r (0x0D) bytes inside data: fields or comment lines.
Server logs showing user-supplied fields with embedded carriage returns being passed to EventStream helpers.
Client-side telemetry reporting SSE event: types the application does not itself emit.

Detection Strategies

Inspect HTTP responses with Content-Type: text/event-stream for \r bytes that are not part of a normal \r\n line terminator sequence.
Add application-layer logging around h3 EventStream push, send, and comment-writing calls to capture input containing control characters.
Perform a dependency audit with npm ls h3 or equivalent to enumerate versions below 1.15.9 across services.

Monitoring Recommendations

Alert on unexpected SSE event names arriving at client applications that only expect a known event vocabulary.
Track upgrades of the h3 package in build artifacts and container images to confirm remediation coverage over time.
Monitor Web Application Firewall (WAF) or reverse proxy logs for request payloads containing encoded %0D sequences targeting SSE endpoints.

How to Mitigate CVE-2026-86252

Immediate Actions Required

Upgrade h3 to version 1.15.9 or later across all applications and transitive dependencies.
Audit application code for SSE endpoints that echo untrusted input into data or comment fields.
Rebuild and redeploy container images and serverless bundles pinned to older h3 releases.

Patch Information

The issue is fixed in h3 version 1.15.9. The patch extends the prior newline sanitization to also strip or reject carriage return characters in EventStream data payloads and comment fields. Consult the GitHub Security Advisory GHSA-4hxc-9384-m385 for the authoritative patch reference.

Workarounds

Sanitize user input before passing it to SSE push calls by removing \r and \n characters.
Restrict SSE endpoints to trusted server-generated content until the upgrade is applied.
Place a reverse proxy filter in front of SSE endpoints to reject responses containing bare carriage returns inside event fields.

bash

# Upgrade h3 to the patched release
npm install h3@^1.15.9
npm ls h3