{"action":"Upgrade h3 to 2.0.1-rc.18 or later.","affected":[{"fixed":"2.0.1-rc.18","introduced":"2.0.1-rc.17"}],"component":"h3","cve_ids":["CVE-2026-86205"],"ecosystem":"npm","epss":0.00271,"exploited":false,"fixed_versions":["2.0.1-rc.18"],"ghsa_id":"GHSA-fp4x-ggrf-wmc6","id":"tcs_01M5KFNW75SY36ZD49TN22TVZD","modified_at":"2026-09-10T03:51:00.303376066Z","published_at":"2026-03-23T21:48:24Z","references":["https://osv.dev/vulnerability/GHSA-fp4x-ggrf-wmc6","https://github.com/h3js/h3/security/advisories/GHSA-fp4x-ggrf-wmc6","https://github.com/h3js/h3/commit/459a1c6593365b0810e9c502df7c3e82837321d7","https://github.com/h3js/h3","https://github.com/h3js/h3/releases/tag/v2.0.1-rc.18"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-fp4x-ggrf-wmc6","url":"https://osv.dev/vulnerability/GHSA-fp4x-ggrf-wmc6"}],"summary":"H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation"}