CVE-2026-86250
1 advisory.
npm/h3 CVE-2026-86250: medium 5.3, EPSS 0.49%
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Action: Upgrade h3 to 2.0.1-rc.18 or later.
npm i h3@2.0.1-rc.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-beta.4 | 2.0.1-rc.18 | - |
Fixed versions
| 2.0.1-rc.18 |
Sources
- osv: GHSA-q5pr-72pq-83v3
- https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3
- https://nvd.nist.gov/vuln/detail/CVE-2026-86250
- https://github.com/h3js/h3/commit/399257cb406fbeda313d88c1e288a15124fc82af
- https://github.com/h3js/h3
- https://github.com/h3js/h3/releases/tag/v2.0.1-rc.18
- https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie
CVE-2026-86250 · published · modified · JSON