CVE-2026-86252

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86252
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86252.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86252
Aliases
Published
2026-09-06T12:00:27Z
Modified
2026-09-10T03:30:57Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
h3 before 1.15.9 SSE Event Injection via Carriage Return
Details

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86252.json"
}
References

Affected packages

Git / github.com/h3js/h3

Affected ranges

Type
GIT
Repo
https://github.com/h3js/h3
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e8d43a7703d0d5c8bbc09748db1d8b9f3c51b42
Introduced
8120545c3ce65f0149f59d72d4db7cb1a53b83e3
Fixed
388b8f06e060a219d11bbc6be7f70f38d8bbea01
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.15.9"
        },
        {
            "introduced": "2.0.0-beta.0"
        },
        {
            "fixed": "2.0.1-rc.17"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.6.0
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.12
v0.7.13
v0.7.14
v0.7.15
v0.7.16
v0.7.17
v0.7.18
v0.7.19
v0.7.2
v0.7.20
v0.7.21
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.10.0
v1.10.1
v1.10.2
v1.11.0
v1.11.1
v1.12.0
v1.13.0
v1.13.1
v1.14.0
v1.15.0
v1.15.1
v1.15.2
v1.15.4
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.8.0
v1.8.0-rc.0
v1.8.0-rc.1
v1.8.0-rc.2
v1.8.0-rc.3
v1.8.1
v1.8.2
v1.9.0
v2.*
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-beta.5
v2.0.0-rc.1
v2.0.1-rc.10
v2.0.1-rc.11
v2.0.1-rc.12
v2.0.1-rc.13
v2.0.1-rc.14
v2.0.1-rc.15
v2.0.1-rc.16
v2.0.1-rc.2
v2.0.1-rc.3
v2.0.1-rc.4
v2.0.1-rc.5
v2.0.1-rc.6
v2.0.1-rc.7
v2.0.1-rc.8
v2.0.1-rc.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86252.json"