⬆️ Update dependency h3 to v1.15.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
h3 (source)	1.15.3 → 1.15.5

---

h3 v1 has Request Smuggling (TE.TE) issue

CVE-2026-23527 / GHSA-mp2g-9vg9-f4cg

More information

Details

I was digging into h3 v1 (specifically v1.15.4) and found a critical HTTP Request Smuggling vulnerability.

Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive.

The Bug: If I send a request with Transfer-Encoding: ChuNked (mixed case), h3 misses it. Since it doesn't see "chunked" and there's no Content-Length, it assumes the body is empty and processes the request immediately.

This leaves the actual body sitting on the socket, which triggers a classic TE.TE Desync (Request Smuggling) if the app is running behind a Layer 4 proxy or anything that doesn't normalize headers (like AWS NLB or Node proxies).

Vulnerable Code (src/utils/body.ts):

if (
    !Number.parseInt(event.node.req.headers["content-length"] || "") &&
    !String(event.node.req.headers["transfer-encoding"] ?? "")
      .split(",")
      .map((e) => e.trim())
      .filter(Boolean)
      .includes("chunked") // <--- This is the issue. "ChuNkEd" returns false here.
  ) {
    return Promise.resolve(undefined);
  }

I verified this locally:

• Sent a Transfer-Encoding: ChunKed request without a closing 0 chunk.
• Express hangs (correctly waiting for data).
• h3 responds immediately (vulnerable, thinks body is length 0).

Impact: Since H3/Nuxt/Nitro is often used in containerized setups behind TCP load balancers, an attacker can use this to smuggle requests past WAFs or desynchronize the socket to poison other users' connections.

Fix: Just need to normalize the header value before checking: .map((e) => e.trim().toLowerCase())

Severity

• CVSS Score: 8.9 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

References

• https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg
• https://github.com/h3js/h3/releases/tag/v1.15.5
• https://nvd.nist.gov/vuln/detail/CVE-2026-23527
• https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097
• https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling
• https://github.com/advisories/GHSA-mp2g-9vg9-f4cg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

h3js/h3 (h3)

v1.15.5

Compare Source

compare changes

[!IMPORTANT]
Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

• readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

v1.15.4

Compare Source

compare changes

🩹 Fixes

• getRequestHost: Return first host from x-forwarded-host (#​1175)

💅 Refactors

• useSession: Backport SessionManager interface to fix types (#​1058)

🏡 Chore

• docs: Fix typos (#​1108)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)
• Izoukhai (@​izoukhai)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[david8478]

No 85 tá dando falha tente colocar outro código