h3 before 1.15.9 SSE Event Injection via Carriage Return

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-86252 · CVE overview and exploitation status

EUVD-2026-72108

GHSA-jqj6-8hxr-7wwq

GHSA-4hxc-9384-m385

cve-program · CVE-2026-86252

• https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
• https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return

euvd · EUVD-2026-72108

• https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
• https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return

nvd · CVE-2026-86252

• https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
• https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return

osv · GHSA-4hxc-9384-m385

• https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
• https://github.com/h3js/h3

No related changes are available here.