srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.
PUBLISHED5.2CWE-706
srvx is vulnerable to middleware bypass via absolute URI in request line
Problem type
Affected products
h3js
srvx
< 0.11.13 - AFFECTED
References
https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr
https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr
https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa
https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa
https://github.com/h3js/srvx/releases/tag/v0.11.13
https://github.com/h3js/srvx/releases/tag/v0.11.13
GitHub Security Advisories
GHSA-p36q-q72m-gchr
srvx is vulnerable to middleware bypass via absolute URI in request line
https://github.com/advisories/GHSA-p36q-q72m-gchrSummary
A pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. file://).
Details
When Node.js receives an absolute URI in the request line (e.g. GET file://hehe?/internal/run HTTP/1.1), req.url is set verbatim to file://hehe?/internal/run. Since this doesn't start with /, NodeRequestURL passes it directly to FastURL as a string, which stores it in #href for lazy manual parsing.
FastURL#getPos() locates the pathname by finding :// then scanning for the next / — but this fails for URLs like file://hehe?/internal/run where a ? appears before the first / after the authority. The manual parser extracts pathname as /internal/run, while native URL correctly parses it as pathname / with search ?/internal/run.
This discrepancy means the router (using the fast-path) matches /internal/run, but if any middleware triggers a deopt to native URL (e.g. by accessing hostname), subsequent middleware sees a different pathname — bypassing route-based middleware guards.
This is a bypass of CVE-2026-33131.
Impact
Route-based middleware (auth guards, rate limiters, etc.) can be bypassed on the Node.js adapter when a prior middleware triggers FastURL deopt. Requires sending a raw HTTP request (not possible from browsers).
Fix
srvx FastURL constructor now deopts to native URL for any string not starting with /, ensuring consistent pathname resolution.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-33732Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-33732",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-03-26T17:21:15.709Z",
"dateReserved": "2026-03-23T17:34:57.560Z",
"datePublished": "2026-03-26T17:21:15.709Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-03-26T17:21:15.709Z"
},
"title": "srvx is vulnerable to middleware bypass via absolute URI in request line",
"descriptions": [
{
"lang": "en",
"value": "srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution."
}
],
"affected": [
{
"vendor": "h3js",
"product": "srvx",
"versions": [
{
"version": "< 0.11.13",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"cweId": "CWE-706",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr",
"name": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa",
"name": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/h3js/srvx/releases/tag/v0.11.13",
"name": "https://github.com/h3js/srvx/releases/tag/v0.11.13",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
}
}
]
}
}
}