CVE-2026-86252
h3 before 1.15.9 SSE Event Injection via Carriage Return
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.
| CWE | CWE-74 |
| Vendor | h3js |
| Product | h3 |
| Published | Sep 6, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for h3js h3
Be the first to know when new medium vulnerabilities affecting h3js h3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
h3js / h3
0 < 1.15.9 2.0.0-beta.0 < 2.0.1-rc.17
References
Credits
🔍 offset