CVE-2026-23527: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23527 is an HTTP Request Smuggling (TE.TE Desync) vulnerability in the h3 Node.js HTTP framework, affecting all versions up to and including v1.15.4. The flaw was discovered by security researcher simonkoeck and disclosed on January 15, 2026, via a GitHub Security Advisory. It affects the npm package h3 used by frameworks such as Nuxt and Nitro. The vulnerability carries a CVSS v3.1 base score of 8.9 (High) per the official GitHub Advisory, though some sources report a score of 9.8 (GitHub Advisory, h3 Security Advisory).

The root cause is a case-sensitive string comparison in the readRawBody function (src/utils/body.ts) that checks for the Transfer-Encoding: chunked header using .includes("chunked") — violating RFC 7230, which mandates case-insensitive header value handling (CWE-444). When an attacker sends a request with a mixed-case value such as Transfer-Encoding: ChuNked and no Content-Length header, h3 fails to recognize the chunked encoding, assumes the body is empty, and returns immediately — leaving the actual request body on the socket. This creates a classic TE.TE desynchronization condition exploitable when h3 is deployed behind a Layer 4 proxy or load balancer that does not normalize headers (e.g., AWS NLB, raw Node.js proxies). The fix, applied in commit 618ccf4, replaces the .includes("chunked") check with a case-insensitive regex: !/\bchunked\b/i.test(...) (h3 Security Advisory, Fix Commit).

Successful exploitation allows attackers to smuggle malicious HTTP requests past Web Application Firewalls (WAFs), desynchronize socket connections, and poison other users' HTTP sessions in shared connection pools. Because H3/Nuxt/Nitro applications are commonly deployed in containerized environments behind TCP load balancers, the attack surface is broad and the scope of impact extends beyond the directly vulnerable component (scope: Changed). Confidentiality and integrity impacts are rated High, as attackers can intercept or manipulate other users' requests and responses, while availability impact is rated Low (GitHub Advisory, h3 Security Advisory).

A proof-of-concept demonstrating the vulnerability is publicly available via the GitHub Security Advisory and a researcher write-up at simonkoeck.com. The vulnerability requires no authentication and no user interaction, though exploitation complexity is rated High because it requires a specific network topology (Layer 4 proxy that does not normalize headers). As of the time of disclosure, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.042–0.043%, placing it in the 14th percentile for exploitation likelihood. The vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using the h3 npm package (versions ≤ 1.15.4), particularly those deployed behind Layer 4 load balancers or proxies that do not normalize HTTP headers (e.g., AWS NLB, raw Node.js reverse proxies). Nuxt.js and Nitro-based applications are common targets.
2. Craft the smuggling request: Construct an HTTP request with a mixed-case Transfer-Encoding header (e.g., Transfer-Encoding: ChuNked) and no Content-Length header. Include a chunked-encoded body that embeds a second, hidden HTTP request.
3. Send the request: Transmit the crafted request through the Layer 4 proxy to the h3 backend. The proxy forwards the full request including the body; h3 misses the Transfer-Encoding header due to the case-sensitive check and processes the request as if the body is empty.
4. Exploit the desync: The leftover body data on the socket is interpreted by h3 as the beginning of the next HTTP request. This allows the attacker to prepend arbitrary content to a subsequent legitimate user's request, effectively poisoning their session or smuggling a request that bypasses WAF rules.
5. Achieve objective: Depending on the application, the attacker may be able to bypass authentication controls, access restricted endpoints, steal session tokens from other users, or exfiltrate sensitive data (h3 Security Advisory, Fix Commit).

• Network: HTTP requests to h3-backed endpoints containing Transfer-Encoding headers with mixed-case values (e.g., ChuNked, CHUNKED, Chunked) rather than the standard lowercase chunked; unexpected or malformed chunked-encoded request bodies without a terminating 0\r\n\r\n chunk.
• Logs: Application or proxy access logs showing requests with non-standard Transfer-Encoding header casing; anomalous request sequences where a single TCP connection appears to carry multiple logical HTTP requests; unexpected 400/500 errors from downstream services following seemingly normal requests.
• Process/Application Behavior: Users reporting unexpected responses that appear to contain content from other users' requests; WAF bypass events where requests reach the backend that should have been blocked; session confusion or cross-user data leakage reports in application logs (h3 Security Advisory).

The primary remediation is to upgrade the h3 npm package to version 1.15.5 or later, which normalizes the Transfer-Encoding header value to lowercase before performing the chunked comparison using a case-insensitive regex (h3 Release v1.15.5). For organizations unable to patch immediately: (1) configure Layer 4 load balancers or proxies to normalize Transfer-Encoding header values to lowercase before forwarding; (2) deploy WAF rules to detect and block requests with mixed-case Transfer-Encoding headers; (3) monitor for anomalous request patterns indicative of smuggling attempts. Upgrading to v1.15.5 is the only complete fix (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher simonkoeck, who is credited in the official GitHub Security Advisory and published a detailed write-up at simonkoeck.com. The Hacker Wire covered the vulnerability with a dedicated article shortly after disclosure. The h3 maintainer (pi0) responded promptly, releasing the patched version v1.15.5 on the same day as the advisory (January 15, 2026). Community reaction on GitHub was positive toward the quick patch, with the release receiving reactions from multiple contributors (h3 Security Advisory, h3 Release v1.15.5).