chore(deps): update dependency h3 to v1.15.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
h3 (source)	1.13.0 → 1.15.5

GitHub Vulnerability Alerts

CVE-2026-23527

I was digging into h3 v1 (specifically v1.15.4) and found a critical HTTP Request Smuggling vulnerability.

Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive.

The Bug: If I send a request with Transfer-Encoding: ChuNked (mixed case), h3 misses it. Since it doesn't see "chunked" and there's no Content-Length, it assumes the body is empty and processes the request immediately.

This leaves the actual body sitting on the socket, which triggers a classic TE.TE Desync (Request Smuggling) if the app is running behind a Layer 4 proxy or anything that doesn't normalize headers (like AWS NLB or Node proxies).

Vulnerable Code (src/utils/body.ts):

if (
    !Number.parseInt(event.node.req.headers["content-length"] || "") &&
    !String(event.node.req.headers["transfer-encoding"] ?? "")
      .split(",")
      .map((e) => e.trim())
      .filter(Boolean)
      .includes("chunked") // <--- This is the issue. "ChuNkEd" returns false here.
  ) {
    return Promise.resolve(undefined);
  }

I verified this locally:

• Sent a Transfer-Encoding: ChunKed request without a closing 0 chunk.
• Express hangs (correctly waiting for data).
• h3 responds immediately (vulnerable, thinks body is length 0).

Impact: Since H3/Nuxt/Nitro is often used in containerized setups behind TCP load balancers, an attacker can use this to smuggle requests past WAFs or desynchronize the socket to poison other users' connections.

Fix: Just need to normalize the header value before checking: .map((e) => e.trim().toLowerCase())

---

Release Notes

h3js/h3 (h3)

v1.15.5

Compare Source

compare changes

[!IMPORTANT]
Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

• readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

v1.15.4

Compare Source

compare changes

🩹 Fixes

• getRequestHost: Return first host from x-forwarded-host (#​1175)

💅 Refactors

• useSession: Backport SessionManager interface to fix types (#​1058)

🏡 Chore

• docs: Fix typos (#​1108)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)
• Izoukhai (@​izoukhai)

v1.15.3

Compare Source

compare changes

🩹 Fixes

• serveStatic: Omit decoded id from statusMessage (#​1044)

v1.15.2

Compare Source

compare changes

🩹 Fixes

• Handle FormData body (3757072 f38dd03 0c9b276)
• cache: Correct comparison in cache headers (#​1034)
• Handle Headers when merging proxy headers (#​1027)
• setCookie: Unique by name, domain, and path only (#​1042)

❤️ Contributors

• Kricsleo (@​kricsleo)

v1.15.1

Compare Source

compare changes

🩹 Fixes

• setCookie: Properly merge and dedup set-cookie header (#​981)

v1.15.0

Compare Source

compare changes

• Migrate from unenv v1 to node-mock-http (#​970)

v1.14.0

Compare Source

compare changes

🚀 Enhancements

• session: Allow using with crossws hooks (#​960)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kanonji (@​kanonji)

v1.13.1

Compare Source

compare changes

🩹 Fixes

• proxy: Ignore incoming accept-encoding header (#​914)
• proxy: Pass host for local targets (#​946)

📖 Documentation

• Fix typos (#​917, #​918, #​919)
• Remove duplicate list (#​939)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Mak (@​Makkalay)
• Daniel Rentz (@​danielrentz)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f529bef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

✅ Deploy Preview for enspire-staging ready!

Name	Link
🔨 Latest commit	f529bef
🔍 Latest deploy log	https://app.netlify.com/projects/enspire-staging/deploys/69696b1c2a56520008cf4397
😎 Deploy Preview	https://deploy-preview-699--enspire-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.