CVE-2026-86253: h3 npm Package Path Traversal Vulnerability

CVE-2026-86253 Overview

CVE-2026-86253 is a path traversal vulnerability in the h3 npm package, affecting versions at or below 2.0.1-rc.14. The flaw resides in the serveStatic() handler when running on Node.js deployments. The library fails to normalize event.url.pathname before passing it to decodeURI(), allowing percent-encoded dot segments (%2e%2e) to decode into ../ sequences without sanitization. An unauthenticated remote attacker can craft HTTP requests to read arbitrary files outside the configured static directory. Maintainers addressed the issue in 1.15.6 and 2.0.1-rc.15.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host filesystem accessible to the Node.js process, including configuration files, credentials, and source code.

Affected Products

h3 npm package versions <= 1.15.5
h3 npm package versions <= 2.0.1-rc.14
Node.js applications exposing endpoints via serveStatic()

Discovery Timeline

2026-09-06 - CVE-2026-86253 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86253

Vulnerability Analysis

The h3 HTTP framework provides a serveStatic() utility to serve files from a designated directory. On Node.js targets, the handler consumes event.url.pathname directly and forwards it to decodeURI() without first normalizing path separators or resolving relative segments. This ordering violates safe path-handling practices defined under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Because the URL parser preserves percent-encoded characters as literal bytes, sequences such as %2e%2e%2f survive normalization checks that only inspect literal ../ patterns. Once decodeURI() runs, the encoded segments become real directory traversal operators. The subsequent filesystem call then resolves outside the intended static root.

Exploitation requires no authentication and no user interaction. The vulnerability allows disclosure of any file the Node.js process can read, including .env files, private keys, session stores, and application source code.

Root Cause

The root cause is an order-of-operations defect in URL handling. The serveStatic() code path decodes before validating or normalizing, and it does not verify that the resolved absolute path remains within the configured static root using a canonical prefix check.

Attack Vector

An attacker sends an HTTP GET request to any route served by serveStatic(), embedding percent-encoded traversal sequences in the URL path. For example, a request path containing %2e%2e%2f%2e%2e%2fetc%2fpasswd decodes server-side to ../../etc/passwd, which the file handler then reads and returns in the HTTP response body. See the GitHub Security Advisory GHSA-wr4h-v87w-p3r7 and the VulnCheck Path Traversal Advisory for additional technical context.

Detection Methods for CVE-2026-86253

Indicators of Compromise

HTTP access log entries containing %2e%2e, %2E%2E, ..%2f, or %2f.. in the request path targeting static asset routes.
Unexpected 200 OK responses returning content types or byte lengths inconsistent with the configured static directory.
Outbound reads or process access to sensitive files such as /etc/passwd, .env, id_rsa, or application configuration files by the Node.js process.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that decode request paths recursively and block traversal patterns after normalization.
Inventory Node.js applications and dependency manifests (package.json, package-lock.json) for h3 versions at or below 1.15.5 or 2.0.1-rc.14.
Correlate reverse proxy logs with filesystem audit events to identify successful reads outside the declared static root.

Monitoring Recommendations

Enable Node.js process-level file access telemetry and alert on reads outside application working directories.
Ingest HTTP access logs into a centralized analytics platform and hunt for encoded traversal sequences over rolling 24-hour windows.
Monitor egress traffic from application servers for anomalous response sizes on static asset endpoints.

How to Mitigate CVE-2026-86253

Immediate Actions Required

Upgrade h3 to version 1.15.6 for the 1.x branch or 2.0.1-rc.15 (or later) for the 2.x branch.
Audit all application routes that invoke serveStatic() and confirm they are behind the patched library version.
Rotate any credentials, API keys, or secrets stored in files reachable from the Node.js process, as disclosure may have occurred.

Patch Information

The maintainers of h3 released fixed versions 1.15.6 and 2.0.1-rc.15. The patch normalizes event.url.pathname and validates that the resolved filesystem path remains within the configured static root before performing any read operation. Refer to the GitHub Security Advisory GHSA-wr4h-v87w-p3r7 for commit references and release notes.

Workarounds

If patching is not immediately feasible, front the application with a reverse proxy or WAF that decodes and normalizes request paths before forwarding them.
Restrict the Node.js process using operating system controls such as filesystem permissions, chroot, or containerization to limit readable files.
Temporarily disable routes that call serveStatic() and serve static assets via a hardened web server such as Nginx or a CDN.

bash

# Upgrade h3 to a patched release
npm install h3@1.15.6
# or, for the 2.x pre-release branch
npm install h3@2.0.1-rc.15

# Verify the installed version
npm ls h3