CVE-2026-33732 Details
Description
srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.
A middleware bypass vulnerability has been identified in srvx versions prior to 0.11.13. The issue arises from a pathname parsing discrepancy in the FastURL component, which allows for middleware bypass on the Node.js adapter. This vulnerability is triggered when a raw HTTP request includes an absolute URI with a non-standard scheme, such as 'file://'. In affected versions, the FastURL constructor does not properly handle these URIs, leading to inconsistent pathname resolution. As a result, route-based middleware guards can be bypassed, potentially allowing unauthorized access or actions.
Upgrade to srvx version 0.11.13 or later, where this vulnerability has been fixed by ensuring that the FastURL constructor properly handles absolute URIs by deoptimizing to the native URL for any string not starting with a slash.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr | [email protected] | MitigationVendor Advisory |
| https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa | [email protected] | Patch |
| https://github.com/h3js/srvx/releases/tag/v0.11.13 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| h3 srvx | < 0.11.13 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |