CVE-2026-86253: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in h3js h3

The h3 npm package versions <= 2.0.1-rc.14 contain a path traversal vulnerability in the serveStatic() function. On Node.js deployments, event.url.pathname is not normalized properly, allowing percent-encoded dot segments (%2e%2e) to be decoded into '../' sequences without sanitization. This enables an unauthenticated remote attacker to send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. The vulnerability is fixed in versions 1.15.6 and 2.0.1-rc.15.

An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files outside the intended static directory on affected systems. This can lead to unauthorized disclosure of sensitive information. The CVSS 4.0 score is 8.2 (high severity), indicating a significant impact due to network attack vector, no privileges required, and high confidentiality impact.

Upgrade affected h3 package versions to 1.15.6 or later, or 2.0.1-rc.15 or later, where the vulnerability is fixed. No other mitigations are indicated by the vendor advisory.