CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2026-23527
Critical (9.8) in h3 h3. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in h3 1.15.5.
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Affected
- h3:h3
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mp2g-9vg9-f4cg | npm | h3 | <1.15.5 | 1.15.5 |