CVE-2026-86251

h3 before version 1.15.9 contains a path traversal vulnerability (CWE-22) in its serveStatic utility, caused by a double-decoding flaw in request-path handling. A request path containing double-encoded dot sequences such as %252e%252e is decoded to %2e%2e, which survives h3's resolveDotSegments() because that function only checks for literal '.' characters; when the resulting asset ID is then resolved by URL-based backends such as a CDN, S3, or other object storage, %2e%2e is interpreted as '..' per RFC 3986, enabling traversal outside the intended asset root. An unauthenticated remote attacker can thereby read arbitrary files from the backend storage, with high confidentiality impact and no integrity or availability impact per the CVSS 4.0 vector. Users of h3's serveStatic feature, particularly deployments serving static assets from URL-based (CDN/S3/object-storage) backends, are affected, and the fix is in version 1.15.9. There are no known public proofs of concept, no reports of exploitation in the wild, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade h3 to version 1.15.9 or later. Audit whether your deployment uses serveStatic backed by CDN, S3, or other object storage, review backend access logs for requests containing double-encoded dot sequences, and as an interim mitigation normalize or block double-encoded dot sequences at the proxy/WAF layer.