High severity7.5NVD Advisory· Published Sep 6, 2026· Updated Sep 18, 2026
CVE-2026-86250
CVE-2026-86250
Description
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
h3npm | >= 2.0.0-beta.4, < 2.0.1-rc.18 | 2.0.1-rc.18 |
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-q5pr-72pq-83v3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-86250ghsaADVISORY
- github.com/h3js/h3/commit/399257cb406fbeda313d88c1e288a15124fc82afghsaWEB
- github.com/h3js/h3/releases/tag/v2.0.1-rc.18ghsaWEB
- github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3nvdWEB
- www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookienvdWEB
News mentions
0No linked articles in our index yet.