CVE-2026-86205

Medium

Description

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a Location header interpreted by browsers as a protocol-relative redirect to an external domain.

SeverityMedium

CVSS5.4

Exploit probability—

ProductH3

PublishedSep 6, 2026

First seenSep 6, 2026

Weakness typeCWE-601Open redirect

How to fix

Update

h32.0.1-rc.18 or later

Vendor advisories

github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6

Affected products

Product	Affected versions	Fixed in
h3npm	2.0.1-rc.17 ≤ v < 2.0.1-rc.18	2.0.1-rc.18

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.