CVE-2026-86253

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86253", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-06T11:35:19.316Z", "datePublished": "2026-09-06T12:00:28.232Z", "dateUpdated": "2026-09-10T15:04:40.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:28.232Z"}, "datePublic": "2026-03-17T00:00:00.000Z", "title": "h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments", "descriptions": [{"lang": "en", "value": "h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "h3js", "product": "h3", "defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "versions": [{"version": "0", "status": "affected", "lessThan": "1.15.6", "versionType": "semver"}, {"version": "1.15.6", "status": "unaffected", "versionType": "semver"}, {"version": "2.0.0-beta.0", "status": "affected", "lessThan": "2.0.1-rc.15", "versionType": "semver"}, {"version": "2.0.1-rc.15", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wr4h-v87w-p3r7)"}, {"name": "VulnCheck Advisory: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments"}], "credits": [{"lang": "en", "value": "0xkakash1", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T14:19:05.242837Z", "id": "CVE-2026-86253", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:04:40.108Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86253", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T14:19:05.242837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T14:19:05.885Z"}}], "cna": {"title": "h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments", "credits": [{"lang": "en", "type": "reporter", "value": "0xkakash1"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "h3js", "product": "h3", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.6", "versionType": "semver"}, {"status": "unaffected", "version": "1.15.6", "versionType": "semver"}, {"status": "affected", "version": "2.0.0-beta.0", "lessThan": "2.0.1-rc.15", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.15", "versionType": "semver"}], "packageURL": "pkg:npm/h3", "defaultStatus": "unaffected"}], "datePublic": "2026-03-17T00:00:00.000Z", "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7", "name": "GitHub Security Advisory (GHSA-wr4h-v87w-p3r7)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments", "name": "VulnCheck Advisory: h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:28.232Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86253", "state": "PUBLISHED", "dateUpdated": "2026-09-10T15:04:40.108Z", "dateReserved": "2026-09-06T11:35:19.316Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-06T12:00:28.232Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "product": "h3", "vendor": "h3js", "versions": [{"lessThan": "1.15.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.15.6", "versionType": "semver"}, {"lessThan": "2.0.1-rc.15", "status": "affected", "version": "2.0.0-beta.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.15", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15."}], "id": "CVE-2026-86253", "lastModified": "2026-09-10T16:18:02.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86253", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T14:19:05.242837Z", "version": "2.0.3"}}]}, "published": "2026-09-06T12:17:16.163", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "h3: h3: Arbitrary File Read via Path Traversal", "id": "2529156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529156"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.", "A flaw was found in h3, an npm package. An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to endpoints served by the `serveStatic()` function. On Node.js deployments, the `event.url.pathname` is not properly normalized, allowing percent-encoded dot segments to be decoded into directory traversal sequences without sanitization. This path traversal vulnerability enables the attacker to read arbitrary files outside the intended static directory, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, restrict network access to services utilizing the `h3` `serveStatic()` function to trusted clients and networks only. Implement firewall rules to limit exposure of the affected component, `rhoai/odh-feature-server-rhel9`, to prevent unauthenticated remote attackers from sending crafted requests. This may impact legitimate access to static content served by the component."}, "name": "CVE-2026-86253", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-06T12:00:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86253\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86253\nhttps://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7\nhttps://www.vulncheck.com/advisories/h3-before-1.15.6-path-traversal-via-percent-encoded-dot-segments"], "statement": "Moderate: This path traversal vulnerability in the h3 npm package allows an unauthenticated remote attacker to read arbitrary files from the system. The flaw occurs in Node.js deployments utilizing the `serveStatic()` function, where improper normalization of percent-encoded dot segments leads to information disclosure. This impacts Red Hat OpenShift AI (RHOAI) components that incorporate the vulnerable h3 package.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.15.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.15.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-beta.0,2.0.1-rc.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.1-rc.15"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "h3", "source": "cna", "vendor": "h3js"}, "product": "h3", "vendor": "h3js"}], "created": "2026-09-06T14:00:08.024267+00:00", "updated": "2026-09-06T14:30:09.406431+00:00", "vendors": ["h3js", "h3js$PRODUCT$h3"]}