CVE-2026-86252

Medium

Description

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.

SeverityMedium

CVSS5.3

Exploit probability—

ProductH3

PublishedSep 6, 2026

First seenSep 6, 2026

Weakness typeCWE-74Injection

How to fix

Update

h32.0.1-rc.17, 1.15.9 or later

Vendor advisories

github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385

Affected products

Product	Affected versions	Fixed in
h3npm	2.0.0-beta.0 ≤ v < 2.0.1-rc.17, v < 1.15.9	2.0.1-rc.17, 1.15.9

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.