8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23527

CVE-2026-23527: Request Smuggling (TE.TE) in h3 v1

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23527

CVE-2026-23527:

8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
h3	npm	<= 1.15.4	1.15.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the h3 library due to a case-sensitive check for the Transfer-Encoding header, which can lead to a TE.TE request smuggling attack. The provided vulnerability description explicitly identifies the readRawBody function in src/utils/body.ts as the source of the issue.

Analysis of the fixing commit 618ccf4 confirms this. The patch modifies the readRawBody function to replace a case-sensitive includes("chunked") check with a case-insensitive regular expression /\bchunked\b/i.test(...).

The removed code block is direct evidence of the vulnerability. It fails to correctly identify chunked encoding when the Transfer-Encoding header value uses non-lowercase characters (e.g., ChunKed), as allowed by RFC 7230. This logic error would cause the function to incorrectly assume the request has no body, leading to the desynchronization issue at the core of the request smuggling vulnerability. Therefore, readRawBody is the identified vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

readRawBody

src/utils/body.ts

The function `readRawBody` in `src/utils/body.ts` was vulnerable to HTTP Request Smuggling. It performed a case-sensitive check for the 'chunked' value in the 'Transfer-Encoding' header. An attacker could use a mixed-case value (e.g., 'ChuNkEd'), causing the function to incorrectly determine that the request has no body. This desynchronizes the request handling between the h3 application and an upstream proxy (like a load balancer), allowing the attacker to smuggle a malicious request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.