CVE-2026-86253

h3, a Node.js HTTP framework published on npm, contains a path traversal flaw (CWE-22) in its serveStatic() helper: on Node.js deployments the request's event.url.pathname is not normalized, so percent-encoded dot segments such as %2e%2e reach decodeURI(), are decoded into ../ sequences, and are never sanitized. An unauthenticated remote attacker can send crafted requests to any endpoint served through serveStatic() to escape the intended static directory. The attacker gains read access to arbitrary files readable by the Node.js process (CVSS 4.0 score 8.2 high, with high confidentiality impact and no integrity or availability impact), though the high attack complexity and present attack requirements suggest some configurations, such as front-ends that normalize the URL path, may not be exploitable. Any application using serveStatic() to serve static files on Node.js is affected: all versions up to and including 2.0.1-rc.14 are vulnerable, with fixes shipped in 1.15.6 on the 1.x line and 2.0.1-rc.15 on the 2.x line. No exploitation is currently known: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade h3 to 1.15.6 (1.x line) or 2.0.1-rc.15 (2.x line), and audit your dependency tree since h3 is commonly pulled in transitively by frameworks such as Nitro (Nuxt). As an interim mitigation, place a front-end proxy or middleware that normalizes and decodes the request path (collapsing percent-encoded %2e%2e dot segments) in front of any Node.js server using serveStatic(). Review access logs for requests containing %2e targeting static-file routes, and check for anomalous reads of files outside the intended static directory.