h3js has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 4. The median CVSS is 5.7 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-86251Medium· 5.9h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility45CVE-2026-86205Medium· 5.4h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname42CVE-2026-86252Medium· 5.3h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns41CVE-2026-86253Medium· 5.9h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic()33
h3js vulnerabilities
CVEs affecting h3js, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-86253Medium· 5.9h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic()
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decode…
CVE-2026-86252Medium· 5.3PoCh3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type di…
CVE-2026-86251Medium· 5.9PoCh3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives r…
CVE-2026-86205Medium· 5.4PoCh3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname
h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash …