A double‑decoding flaw in h3 < 1.15.9’s serveStatic function allows a request path that contains double‑encoded dot sequences such as %252e%252e to be decoded to %2e%2e. The resolveDotSegments() routine only checks for literal '.' characters, so the double‑decoded string bypasses dot‑segment removal. When the resulting asset ID is resolved by URL‑based backends—including CDNs, S3, or other object storage—RFC 3986 treats %2e%2e as ‘..’, enabling an attacker to traverse directories and read arbitrary files. This is a classic Path Traversal (CWE‑22) that can compromise confidentiality and possibly integrity if configuration files or credentials are exposed.

The vulnerability affects the h3js:h3 JavaScript library. Any deployment of h3 versions earlier than 1.15.9 that uses the serveStatic utility and serves static assets from remote or cloud backends is impacted. The affected path is the serveStatic entry point which resolves request URLs to backend object identifiers.

The CVSS base score is 8.2, indicating high severity. EPSS details are unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending a crafted HTTP request that contains double‑encoded dot sequences in the path. The attack requires no authentication and exploits standard URL handling logic, making it a straightforward path traversal attack against any exposed h3 service.