Description

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-06T12:17:16.163Z",
  "pubdate": "2026-09-06T12:17:16.163Z",
  "executiveSummary": "The h3 npm package is susceptible to a path traversal vulnerability originating from improper input sanitization within the serveStatic() utility. This flaw permits unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the underlying filesystem of the host server.\nThe vulnerability occurs because the application fails to normalize the event.url.pathname before processing, allowing percent-encoded dot segments (%2e%2e) to be decoded into directory traversal sequences. By crafting malicious requests, an attacker can traverse outside the intended static content root directory, potentially leading to the exposure of sensitive configuration files, source code, or system information.\nThis vulnerability is critical due to its ability to be exploited over the network without requiring any form of authentication. Systems running affected versions of h3 are at high risk of unauthorized information disclosure. Immediate remediation is required through updating to the specified patched versions to ensure that path inputs are correctly sanitized and normalized before filesystem operations occur.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and normalization of user-supplied input within the serveStatic() function of the h3 package. Specifically, the function handles the event.url.pathname property without performing adequate security normalization to mitigate path traversal attacks.\nIn Node.js environments, the h3 framework processes incoming HTTP requests where the pathname is utilized to locate static assets. The vulnerability exists because the package passes the raw pathname directly to decodeURI() without preceding normalization. An attacker can supply a malicious URI containing percent-encoded characters, such as %2e%2e/ (which corresponds to ../). Because decodeURI() is invoked after the initial processing step, the resulting dot-dot-slash sequence is interpreted by the underlying filesystem API as a legitimate instruction to navigate to a parent directory.\nThe attack flow is as follows: 1) The attacker identifies an endpoint handled by serveStatic(). 2) The attacker crafts a request using percent-encoded sequences (e.g., %2e%2e%2f) within the URL path. 3) The h3 component passes this unnormalized string to the file resolution logic. 4) The server-side code decodes the malicious sequence, effectively transforming the requested path into an absolute or relative path that points outside the designated web root (e.g., /static/../../etc/passwd). 5) The server resolves the traversed path and returns the content of the unintended file to the attacker.\nThis vulnerability affects h3 versions <= 2.0.1-rc.14. It is remotely exploitable over standard network protocols, requiring no authentication or specific user privileges. The post-exploitation impact is limited to unauthorized read access, but this can lead to full system compromise if sensitive credentials or environment variables are leaked from the filesystem.\nThe issue is exacerbated by the reliance on decodeURI() on untrusted input without subsequent path validation. By failing to strip or reject traversal sequences before the file retrieval operation, the component effectively allows an attacker to break out of the chroot-like environment intended for static file serving."
}