h3js h3

• CVE-2026-86253 Medium 5.9 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments 0.6%
• CVE-2026-86252 Medium 5.3 h3 before 1.15.9 SSE Event Injection via Carriage Return 0.4%
• CVE-2026-86251 Medium 5.9 h3 before 1.15.9 Path Traversal via Double Decoding 0.4%
• CVE-2026-86250 High 7.5 h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie 0.5%
• CVE-2026-86205 Medium 5.4 h3 before 2.0.1-rc.18 Open Redirect via redirectBack() 0.3%
• CVE-2026-33490 Low 3.7 h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes 0.2%
• CVE-2026-33131 High 7.4 h3 has a middleware bypass with one gadget 0.4%
• CVE-2026-33129 Medium 5.9 h3 has an observable timing discrepancy in basic auth utils 0.3%
• CVE-2026-33128 High 7.5 h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields 0.6%
• CVE-2026-23527 High 8.9 h3 v1 has Request Smuggling (TE.TE) issue 0.6%