🚨 [security] Update h3 1.15.4 → 1.15.5 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ h3 (1.15.4 → 1.15.5) · Repo · Changelog

Security Advisories 🚨

🚨 h3 v1 has Request Smuggling (TE.TE) issue

I was digging into h3 v1 (specifically v1.15.4) and found a critical HTTP Request Smuggling vulnerability.

Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive.

The Bug: If I send a request with Transfer-Encoding: ChuNked (mixed case), h3 misses it. Since it doesn't see "chunked" and there's no Content-Length, it assumes the body is empty and processes the request immediately.

This leaves the actual body sitting on the socket, which triggers a classic TE.TE Desync (Request Smuggling) if the app is running behind a Layer 4 proxy or anything that doesn't normalize headers (like AWS NLB or Node proxies).

Vulnerable Code (src/utils/body.ts):

if (
    !Number.parseInt(event.node.req.headers["content-length"] || "") &&
    !String(event.node.req.headers["transfer-encoding"] ?? "")
      .split(",")
      .map((e) => e.trim())
      .filter(Boolean)
      .includes("chunked") // <--- This is the issue. "ChuNkEd" returns false here.
  ) {
    return Promise.resolve(undefined);
  }

I verified this locally:

• Sent a Transfer-Encoding: ChunKed request without a closing 0 chunk.
• Express hangs (correctly waiting for data).
• h3 responds immediately (vulnerable, thinks body is length 0).

Impact: Since H3/Nuxt/Nitro is often used in containerized setups behind TCP load balancers, an attacker can use this to smuggle requests past WAFs or desynchronize the socket to poison other users' connections.

Fix: Just need to normalize the header value before checking: .map((e) => e.trim().toLowerCase())

Release Notes

1.15.5

compare changes

Important

Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

• readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 11 commits:

• chore(release): v1.15.5
• chore: fix more ts/lint issues
• chore: update deps
• chore: fix ts issue
• fix(readRawBody): fix case-sensitive `Transfer-Encoding` check causing request smuggling risk
• ci: fix publish tag
• chore: update publish tag to 1.x
• chore: update ci
• chore: add `test:types` script
• chore: update ci
• chore: update deps

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[coderabbitai]

Walkthrough

The pull request updates the h3 devDependency in the Tailwind CSS Browser package from version ^1.15.4 to ^1.15.5. This is a minor version increment that appears in the package.json file's devDependencies section. The change consists of a single line modification with no other configuration or functional adjustments.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: updating h3 from 1.15.4 to 1.15.5 patch to address security vulnerabilities, which matches the changeset.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed context about the security vulnerability fix, release notes, and commits for the h3 dependency update.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

---

📜 Recent review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7971167 and 891e394.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• packages/@tailwindcss-browser/package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)

• GitHub Check: Windows
• GitHub Check: Linux
• GitHub Check: Linux / vite
• GitHub Check: Linux / postcss
• GitHub Check: Linux / upgrade
• GitHub Check: macOS
• GitHub Check: Linux / webpack
• GitHub Check: Linux / oxide
• GitHub Check: Linux / cli

🔇 Additional comments (1)

packages/@tailwindcss-browser/package.json (1)

33-33: Verify the h3 1.15.5 release/advisory and lockfile alignment.

h3 v1.15.5 correctly patches GHSA-mp2g-9vg9-f4cg (Request Smuggling TE.TE vulnerability, CVE-2026-23527), which fixed a case-sensitive Transfer-Encoding header check affecting v1.15.4 and earlier. The pnpm-lock.yaml is properly updated with h3@1.15.5 entries, with no lingering older versions.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[depfu]

Sorry, but the merge failed with:

At least 1 approving review is required by reviewers with write access.