CVE-2026-86205: URL Redirection to Untrusted Site ('Open Redirect') in h3js h3

CVE-2026-86205 is an open redirect vulnerability affecting h3 versions >=2.0.1-rc.17 and <2.0.1-rc.18. The issue lies in the redirectBack() utility, which fails to properly sanitize protocol-relative paths in the Referer header pathname. Attackers can exploit this by crafting a same-origin URL containing a double-slash path segment that passes origin validation but results in a Location header that browsers interpret as a protocol-relative redirect to an untrusted external domain.

An attacker can leverage this vulnerability to redirect users to untrusted external sites by exploiting the open redirect flaw. This can facilitate phishing attacks or other social engineering techniques by making malicious URLs appear to originate from a trusted source. However, the vulnerability requires user interaction (UI:P) and has low impact on confidentiality and integrity, resulting in a medium severity rating.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of URLs from affected versions that may exploit this open redirect vulnerability.