CVE-2026-86252
CVE-2026-86252 · h3 before 1.15.9 SSE Event Injection via Carriage Return
This page contains facts from public vulnerability sources. Check the original advisory before updating.
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
h3
- Versions
- ≥ 0, < 1.15.9: Affected (semver)
- 1.15.9: Not affected (semver)
- ≥ 2.0.0-beta.0, < 2.0.1-rc.17: Affected (semver)
- 2.0.1-rc.17: Not affected (semver)
Update to 1.15.9; Update to 2.0.1-rc.17
h3 npm
- Affected ranges
- SEMVER: ≥ 2.0.0-beta.0, < 2.0.1-rc.17
Update to 2.0.1-rc.17
h3 npm
- Affected ranges
- SEMVER: < 1.15.9
Update to 1.15.9