CVE-2026-86251: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in h3js h3

CVE-2026-86251 is a path traversal vulnerability in h3 versions prior to 1.15.9 affecting the serveStatic utility. The issue arises from a double-decoding flaw where request paths containing double-encoded dot sequences (e.g., %252e%252e) are decoded to %2e%2e, which bypasses the resolveDotSegments() function because it only checks for literal '.' characters. When these asset IDs are resolved by URL-based backends such as CDN, S3, or object storage, the %2e%2e sequence is interpreted as '..' according to RFC 3986, enabling attackers to traverse directories and read arbitrary files from the backend storage.

An attacker can exploit this vulnerability to perform path traversal attacks, potentially reading arbitrary files from backend storage systems that rely on URL-based resolution. This could lead to unauthorized disclosure of sensitive information stored in these backends. The vulnerability does not require privileges or user interaction but has a high attack complexity due to the need for crafted requests.

A patch is available for this vulnerability. Since h3 is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to version 1.15.9 or later to ensure the vulnerability is mitigated.