CVE-2026-86250

CVE-2026-86250 is a denial-of-service flaw in the h3 HTTP framework (versions before 2.0.1-rc.18), where setChunkedCookie() and deleteChunkedCookie() fail to validate the chunk count parsed from user-controlled cookie values. An unauthenticated remote attacker can send a crafted Cookie header containing a chunked cookie with an extremely large chunk count, causing the cleanup routine to execute an O(n²) loop that hangs the server process. The attacker gains remote, unauthenticated denial of service — the affected Node.js server process stops responding until restarted — with no confidentiality or integrity impact, consistent with the CVSS 4.0 score of 8.7 (high availability impact only, CWE-400). Any server running h3 2.0.x prior to 2.0.1-rc.18, whether using h3 directly or through frameworks built on it, is affected, with practical impact concentrated where chunked cookies are processed. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days (20th percentile).

What to do: Upgrade h3 to 2.0.1-rc.18 or later — applications using h3 directly or via frameworks that bundle it should rebuild and redeploy with the fixed dependency. Until patched, use a reverse proxy/WAF to cap or normalize incoming Cookie headers (limiting total cookie size and chunk counts) and monitor for hung Node.js processes. Also verify whether your application uses chunked cookies, since the vulnerable code path is exercised when chunked-cookie values are set or deleted.