CVE-2026-86252
1 advisory.
npm/h3 CVE-2026-86252: medium 5.3, EPSS 0.36%
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Action: Upgrade h3 to 1.15.9 or later.
npm i h3@2.0.1-rc.17npm i h3@1.15.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-beta.0 | 2.0.1-rc.17 | - |
| 0 | 1.15.9 | - |
Fixed versions
| 2.0.1-rc.17 | 1.15.9 |
Sources
- osv: GHSA-4hxc-9384-m385
- https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
- https://github.com/h3js/h3
CVE-2026-86252 · published · modified · JSON