Vulnerability in H3js H3
CVE-2026-23527
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It…
Vulnerability class: HTTP Request Smuggling
EPSS: 0.000 (13.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L.
Affected products
- H3js H3 — versions < 1.15.5
Weakness classification (CWE)
References
- https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg (x_refsource_CONFIRM)
- https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097 (x_refsource_MISC)
- https://github.com/h3js/h3/releases/tag/v1.15.5 (x_refsource_MISC)
- https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-23527?
- CVE-2026-23527 is a high-severity vulnerability in H3js H3, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 8.9/10. Published 2026-01-15.
- How severe is CVE-2026-23527?
- High severity. CVSS v3 base score is 8.9 out of 10.