A path traversal flaw exists in the serveStatic function of the h3 JavaScript library, which is used in Node.js applications to serve static files. The flaw occurs because event.url.pathname is not normalized; percent‑encoded dot segments such as %2e%2e are decoded into "../" without sanitization. An unauthenticated attacker can craft HTTP requests containing these sequences to retrieve any file located outside the intended static directory, potentially exposing sensitive data and compromising system confidentiality.

The vulnerability affects h3 packages from the h3js organization, specifically all releases up to and including 1.15.5 and 2.0.1‑rc.14. It is present in Node.js deployments that rely on serveStatic for static content delivery, regardless of authentication or other controls in place.

The CVSS score of 8.2 indicates high severity. Although EPSS data is unavailable and the issue is not listed in CISA KEV, the flaw is exploitable over a publicly reachable HTTP interface and permits the reading of arbitrary files. Attackers need only send crafted requests; no authentication or elevated privileges are required. The vulnerability is prefixed by CWE‑22, highlighting a path traversal weakness.