Vulnerability · Published Sep 6, 2026 · Assigned by VulnCheck
CVE-2026-86252h3 before 1.15.9 SSE Event Injection via Carriage Return
Medium 5.3
In plain English
A medium-severity injection in h3 from h3js. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | h3 | 2.0.1-rc.17 | GHSA-4hxc-9384-m385 |
| npm | h3 | 1.15.9 | GHSA-4hxc-9384-m385 |
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-4hxc-9384-m385) vendor-advisory
- VulnCheck Advisory: h3 before 1.15.9 SSE Event Injection via Carriage Return third-party-advisory