CVE-2026-86252: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in h3js h3

h3js h3 versions prior to 1.15.9 and specific 2.0.0 beta and release candidate versions do not properly sanitize carriage return characters in EventStream data and comment fields. This improper neutralization allows attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data. This vulnerability bypasses a prior fix that only addressed newline injection, making it a distinct injection flaw.

An attacker can exploit this vulnerability to inject arbitrary Server-Sent Events, potentially manipulating the event stream processed by downstream components. This could lead to unexpected behavior in applications consuming the SSE data, including injection of unauthorized events. The CVSS 4.0 score of 6.9 (medium severity) reflects a network attack vector with no privileges or user interaction required, but with limited impact on integrity.

Users should upgrade h3js h3 to version 1.15.9 or later, or to 2.0.1-rc.17 or later for the 2.x beta/RC line, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the affectedVersions data specifying fixed versions.