GHSA-fg72-q65g-wm5w

    Dashboard / Vulnerabilities / GHSA-fg72-q65g-wm5w

    GHSA-fg72-q65g-wm5w

    Published: 6 Sept 2026Last Modified: 1 Oct 2026

    Summary: Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

    Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5pr-72pq-83v3. This link is maintained to preserve external references. ## Original Description h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

    References: https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3, https://nvd.nist.gov/vuln/detail/CVE-2026-86250, https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie

    Affected packages

    Package

    Name: h3

    Purl: pkg:npm/h3

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.0.0-beta.4
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-fg72-q65g-wm5w | CVE-DB