CyberRota Analysis
AI-GeneratedThe h3 npm package versions up to 2.0.1-rc.14 are vulnerable to a path traversal flaw in the serveStatic() function, allowing unauthenticated remote attackers to exploit improperly normalized URLs and access arbitrary files outside the designated static directory. This vulnerability poses a medium risk, particularly for applications using Node.js that rely on this package for serving static content. Developers and security teams utilizing affected versions should prioritize updating to 1.15.6 or 2.0.1-rc.15 to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded to ../ sequences without sanitization. An unauthenticated remote attacker can send crafted requests to endpoints served by serveStatic() to read arbitrary files outside the intended static directory. Fixed in 1.15.6 and 2.0.1-rc.15.