CVE-2026-86250: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

CVE-2026-86250 · Severity: high · CVSS 7.5 · Published 2026-09-06

H3 is a lightweight HTTP request event handler library used in Node.js web applications. A vulnerability in its session management allows an unauthenticated attacker to send a single crafted HTTP cookie header that causes the server process to hang indefinitely, blocking all incoming requests. The attack requires no authentication or special permissions—just the ability to send HTTP requests.

Technologies: h3 (npm). Vendors: npm.

Quick answers

Is CVE-2026-86250 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86250 being exploited in the wild.
How severe is CVE-2026-86250?
High severity, with a CVSS score of 7.5, published 6 September 2026.
Which products and versions are affected?
h3 (npm) >= 2.0.0-beta.4, < 2.0.1-rc.18, SEMVER:introduced=2.0.0-beta.4,fixed=2.0.1-rc.18.
Is there a fix for CVE-2026-86250?
Yes. h3 (npm): upgrade to 2.0.1-rc.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86250 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-86250?
Check whether you run h3 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • h3 (npm): upgrade to 2.0.1-rc.18 or later
    npm install h3@2.0.1-rc.18

Technical details

The vulnerability is an input validation flaw in the getChunkedCookieCount() function, which parses the chunk count from a user-controlled cookie value (__chunked__N) without any upper bound check. When setChunkedCookie() or deleteChunkedCookie() functions process a session, they iterate through the claimed number of chunks in O(n²) time without validating the count. An attacker can send a crafted cookie like "h3=__chunked__999999" to trigger cleanup loops that iterate millions of times. Each iteration calls deleteCookie() → setCookie(), which scans all existing response headers, resulting in billions of operations. The attack is unauthenticated and network-accessible. Patches are available in h3 version 2.0.1-rc.18 and later, which add a maximum chunk count constant and validation in getChunkedCookieCount().

Affected products

  • h3 H3 >= 2.0.0-beta.4, < 2.0.1-rc.18

Identifiers

  • CVE-2026-86250
  • GHSA-q5pr-72pq-83v3

Timeline

  • 2026-03-23: disclosed
  • 2026-03-21: patched: Patched in version 2.0.1-rc.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.