The vulnerability arises because the framework’s body parsing logic verifies the Transfer-Encoding header strictly for the value "chunked" with case sensitivity, whereas the HTTP specification dictates header names and values are case-insensitive. An attacker can send a header with differing capitalization to trick the parser into processing a second, smuggled request that the application ignores or treats differently, potentially allowing injection or bypass of application logic. This flaw is categorized as a critical request smuggling flaw that can undermine request integrity and confidentiality.

The affected product is the h3 framework from h3js, intended for Node.js environments. All releases earlier than version 1.15.5 are impacted; the issue was rectified in that release.

The CVSS score of 8.9 indicates a high severity, yet the EPSS score is below 1% suggesting a low likelihood of active exploitation at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog, which further reduces the immediate threat. Attackers would need network access to the vulnerable server and the ability to craft HTTP requests with custom Transfer-Encoding header values. If they succeed, the attack can lead to hidden data delivery, session hijacking, or denial of service.