Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unjs/h3

              main @ 1892ee9
            

Fixes

CVEs

HIGH

Peak severity

25.6%

Coverage

Highlights

Path Traversal: 8 prior fixes. Scrutinize any change in this area.

src/utils/proxy.ts: most-fixed (12 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The highest-count vulnerability class with 8 fixes, spanning multiple components and sink symbols (decodeURI, decodeURIComponent, resolveDotSegments, serveStatic). Recurring theme is canonicalization of pathnames to prevent encoded or non-canonical forms from bypassing route guards or escaping static file serving.

Request Smuggling / HTTP Request Smuggling: Multiple fixes (5 total) address smuggling via proxy header forwarding, malformed percent-encoding, and binary body handling. The proxy component is the primary sink, with issues in createSubRequest, forwardHeaders, and transfer-encoding stripping.

Auth Bypass: Five auth bypass fixes across different components, all related to path or credential parsing that could let unauthenticated requests bypass guards. Includes leading separator runs in static serving, percent-encoded pathname normalization, forgeable constructor.name, x-forwarded-for header spoofing, and Basic auth colon parsing.