{"cve":"CVE-2026-86252","nvd":{"published":"2026-09-06T12:17:16.033","modified":"2026-09-08T20:00:18.870","status":"Awaiting Analysis","description":"h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-74"],"references":["https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385","https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return","https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:52:03.409947763+00:00"},"epss":{"cve":"CVE-2026-86252","score":0.0036,"percentile":0.29844,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4hxc-9384-m385","url":"https://osv.dev/vulnerability/GHSA-4hxc-9384-m385","summary":"h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)","modified":"2026-09-10T03:50:37.291276895Z","packages":[{"ecosystem":"npm","name":"h3","purl":"pkg:npm/h3","ranges":[">=2.0.0-beta.0 <2.0.1-rc.17"],"fixed":["2.0.1-rc.17"]},{"ecosystem":"npm","name":"h3","purl":"pkg:npm/h3","ranges":["<1.15.9"],"fixed":["1.15.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}