CVE-2026-23527 is a high severity request smuggling flaw (CVSS 8.9) in h3, the minimal HTTP framework for JavaScript. Its readRawBody function checked the Transfer-Encoding header for "chunked" case sensitively, although the header is case insensitive. Versions up to 1.15.4 are affected, and h3 1.15.5 fixes it.
What's affected
The GitHub advisory lists h3 up to and including 1.15.4 as affected, in the v1 line, and 1.15.5 as the patched version.
h3 powers other tools. The advisory notes that h3 is often used in containerized setups behind TCP load balancers, and mentions Nuxt and Nitro. You may therefore run it as a transitive dependency without having chosen it.
The advisory says the risk grows when the app runs behind a layer 4 proxy or anything that does not normalize headers.
How to check if you're exposed
Find every copy of h3 in your project and its version:
npm ls h3
pnpm why h3
yarn why h3
Check for several versions, since monorepos often hold more than one. Then look at your deployment. If the app sits behind a TCP level load balancer or a proxy that passes header values through untouched, the smuggling condition is easier to meet.
What to do now
- Upgrade h3 to 1.15.5 or later, directly or through the framework that depends on it.
- If h3 is transitive, update the parent package or add a resolution or override for h3.
- Run
npm ls h3again to confirm there is no old copy left. - Make sure your proxy or load balancer normalizes and validates Transfer-Encoding and Content-Length headers.
- Rebuild and redeploy images so the fixed code ships.
Why it matters
The weakness is CWE-444 (HTTP Request Smuggling). HTTP header names and many of their values are case insensitive, but the h3 code compared the value with one exact spelling. A request with a different capitalization looked like it had no body, so the server processed it at once and left the rest of the data on the connection, where it can be read as the start of the next request.
Request smuggling relies on two systems disagreeing. Here the proxy and h3 can disagree about where a request ends. The advisory says an attacker could use this to get past WAF checks or desynchronize connections. The fix is to normalize the value before the comparison. The record does not mark this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is h3 v2 affected?
The advisory is titled for h3 v1 and lists versions up to 1.15.4, so check the advisory for your line.
Why does the proxy matter?
The attack depends on the proxy and h3 reading the request differently, which is more likely when the proxy does not normalize headers.
Sources
Last reviewed: 19 October 2026.
