GHSA-72gr-qfp7-vwhw

What it actually does

The flaw is a path traversal weakness in the h3 npm package's static-file serving logic. The affected serveStatic path handling can decode URL-encoded input more than once, allowing sequences such as %252e%252e to become ../ after an initial validation step has already attempted to resolve or reject dot segments. If an application uses the vulnerable h3 serveStatic functionality to serve files from a constrained directory, a crafted request path may bypass resolveDotSegments protections and access files outside the intended static root, subject to the runtime process's filesystem permissions and surrounding routing/configuration.

Why it matters to the business

Applications using vulnerable h3 versions to serve static content may expose source files, configuration files, secrets, build artifacts, or other local files that were not intended to be public. This can lead to data leakage, credential compromise, service disruption, and follow-on attacks against infrastructure or users. The CVSS score is moderate and there is no known KEV listing or public exploit maturity in the provided data, but internet-facing static file handlers should still be patched promptly because path traversal bugs are simple to test and can become widely scanned after disclosure.

How an attack unfolds

An attacker identifies an application endpoint backed by h3's serveStatic functionality. They send HTTP requests containing double-encoded traversal sequences, for example using %252e%252e to survive the first normalization check and then decode into .. later in processing. If the vulnerable code validates or resolves the path before the final decoded value is used for filesystem access, the request can escape the configured static directory. The attacker then iterates through likely file locations and filenames, attempting to retrieve readable files such as package metadata, environment files, configuration files, logs, source maps, private assets, or application source. Successful exploitation does not require authentication unless the affected static route is otherwise protected, and impact depends on which files are reachable by the application process.

How to fix it

Upgrade h3 to version 1.15.9 or later. For npm-based projects, update the direct dependency or the transitive dependency resolution so that h3 resolves to a fixed version, then rebuild and redeploy affected applications. If immediate upgrade is not possible, disable or restrict h3 serveStatic usage, place sensitive files outside the application process's readable paths, enforce deny rules for encoded traversal patterns at a reverse proxy or WAF, and ensure static file serving is constrained to an allowlisted directory with final-path canonicalization after all decoding. Treat mitigations as temporary; the durable fix is to deploy the patched package.

How to confirm the fix worked

Confirm dependency resolution shows h3 version 1.15.9 or later in package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, or the deployed artifact. Run npm ls h3, pnpm why h3, or yarn why h3 as appropriate to identify vulnerable direct or transitive installations. Test exposed static routes with double-encoded traversal payloads such as /%252e%252e%252fpackage.json and verify the server returns a safe error, 400/403/404, or the expected static-root behavior rather than files outside the static directory. Review container images, serverless bundles, and built deployment packages to ensure the fixed version is actually present in production, not only in source control.

Typical attack path

1. Discover an h3-based application or endpoint serving static files.
2. Probe static routes with benign encoded path variations to infer how URL decoding and normalization are handled.
3. Send crafted requests containing double-encoded traversal payloads such as %252e%252e%252f to bypass dot-segment protection.
4. Attempt to access files outside the intended static directory using common target paths and filenames.
5. Use any disclosed source code, configuration data, credentials, or secrets for additional reconnaissance or follow-on compromise.

How to detect it

Review HTTP access logs, reverse proxy logs, CDN/WAF events, and application logs for requests containing double-encoded path traversal sequences. Focus on URL paths or query parameters containing %252e, %252e%252e, %252f, %255c, or combinations that decode to ../ or ..\. Investigate requests returning HTTP 200, 206, or unusually large response sizes when the path includes encoded traversal patterns, especially if followed by requests for common sensitive files. Compare requested paths against files that should only exist outside the static directory. If detailed application logging is available, look for filesystem read attempts outside the configured static root. Also review outbound activity and authentication logs after any confirmed file disclosure, because leaked configuration or secrets may enable follow-on access.

• %252e%252e
• %252e%252e%252f
• %252e%252e%255c
• %252f%252e%252e%252f
• %255c%252e%252e%255c
• /%252e%252e%252fpackage.json
• /%252e%252e%252f.env
• /%252e%252e%252f.env.local
• /%252e%252e%252fpnpm-lock.yaml
• /%252e%252e%252fpackage-lock.json
• /%252e%252e%252fyarn.lock
• /%252e%252e%252fserver.js
• /%252e%252e%252fapp.js
• /%252e%252e%252fconfig.json
• /%252e%252e%252fconfig.js

What your security team should do

• Inventory applications and services that use the h3 npm package, especially internet-facing services and frameworks that include h3 transitively.
• Prioritize upgrading all affected deployments to h3 1.15.9 or later, with highest priority for unauthenticated static-file endpoints.
• Search access logs for double-encoded traversal probes and successful 200 responses involving encoded dot-dot sequences.
• Add temporary WAF or reverse-proxy detection/blocking for repeated or double-encoded ../ patterns while patching is in progress.
• Review exposed application directories for sensitive files that should never be readable by the web process, including environment files, credentials, source maps, and build artifacts.
• After patching, perform regression testing against static routes to confirm encoded traversal payloads cannot escape the intended directory.