Vulnerability · Published Sep 6, 2026 · Assigned by VulnCheck

CVE-2026-86253h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

Medium 5.9

In plain English

A medium-severity path traversal in h3 from h3js. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.6%top 50.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	h3	2.0.1-rc.15	GHSA-wr4h-v87w-p3r7
npm	h3	1.15.6	GHSA-wr4h-v87w-p3r7

Affected products (as reported)

Vendor	Product	Versions
h3js	h3	0 – before 1.15.62.0.0-beta.0 – before 2.0.1-rc.15

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-wr4h-v87w-p3r7) vendor-advisory
VulnCheck Advisory: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments third-party-advisory