Open Redirect in h3 Versions Before 2.0.1-rc.18

Executive Summary

CVE-2026-86205 is an open redirect vulnerability in the h3 library's redirectBack() utility. It occurs because the function fails to properly sanitize protocol-relative paths in the Referer header's pathname. Attackers can exploit this by crafting URLs with double-slash path segments that pass origin validation but cause browsers to redirect to external domains.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your h3 library version. If using npm, run: npm list h3. Versions before 2.0.1-rc.18 are vulnerable. Check application logs for unexpected redirects or protocol-relative URLs in Referer headers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to redirect users from a trusted application to malicious domains. This can lead to phishing attacks, theft of OAuth tokens, or other forms of trust exploitation. Users of affected h3 versions (2.0.1-rc.17 and earlier) are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks or unauthorized data access. If attackers redirect users to malicious domains, they may steal credentials or session tokens, leading to unauthorized access to personal or health data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A successful exploit could violate these regulations by exposing sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the h3 library to version 2.0.1-rc.18 or later immediately. If upgrading is not possible, sanitize the pathname in the redirectBack() function to block protocol-relative paths (//). Review and restrict redirect logic in your application.

Useful 0 Not Useful 0