CVE-2026-86252
mediumh3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events…
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-ret... disclosure@vulncheck.com
- https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385 134c704f-9b21-4f2e-91b3-4a467353bcc0