CVE-2026-33732
March 26, 2026
srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's "FastURL" allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. "file://"). Starting in version 0.11.13, the "FastURL" constructor now deopts to native "URL" for any string not starting with "/", ensuring consistent pathname resolution.
Affected Packages
https://github.com/h3js/srvx.git (GITHUB):
Affected version(s) >=v0.1.1 <v0.11.13Fix Suggestion:
Update to version v0.11.13https://github.com/h3js/srvx.git (GITHUB):
Affected version(s) >=v0.1.1 <v0.11.13Fix Suggestion:
Update to version v0.11.13https://github.com/h3js/srvx.git (GITHUB):
Affected version(s) >=v0.1.1 <v0.11.13Fix Suggestion:
Update to version v0.11.13https://github.com/h3js/srvx.git (GITHUB):
Affected version(s) >=v0.1.1 <v0.11.13Fix Suggestion:
Update to version v0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13srvx (NPM):
Affected version(s) >=0.0.0 <0.11.13Fix Suggestion:
Update to version 0.11.13Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Use of Incorrectly-Resolved Name or Reference
EPSS
Base Score:
0.03