Executive brief
H3 is a lightweight HTTP request event handler library used in Node.js web applications. A vulnerability in its session management allows an unauthenticated attacker to send a single crafted HTTP cookie header that causes the server process to hang indefinitely, blocking all incoming requests. The attack requires no authentication or special permissions—just the ability to send HTTP requests.
Technical details
The vulnerability is an input validation flaw in the getChunkedCookieCount() function, which parses the chunk count from a user-controlled cookie value (__chunked__N) without any upper bound check. When setChunkedCookie() or deleteChunkedCookie() functions process a session, they iterate through the claimed number of chunks in O(n²) time without validating the count. An attacker can send a crafted cookie like "h3=__chunked__999999" to trigger cleanup loops that iterate millions of times. Each iteration calls deleteCookie() → setCookie(), which scans all existing response headers, resulting in billions of operations. The attack is unauthenticated and network-accessible. Patches are available in h3 version 2.0.1-rc.18 and later, which add a maximum chunk count constant and validation in getChunkedCookieCount().
Affected products
- h3 H3 >= 2.0.0-beta.4, < 2.0.1-rc.18
Timeline
- 2026-03-23: disclosed
- 2026-03-21: patched: Patched in version 2.0.1-rc.18