Description
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| h3js | h3 | < 1.15.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | h3 | < 1.15.5 | 1.15.5 | GHSA-mp2g-9vg9-f4cg |