Read the docs
TI-2026-26111 Aliases CVE-2026-33732GHSA-p36q-q72m-gchr

srvx is vulnerable to middleware bypass via absolute URI in request line

Priority LOW 28CWE-706Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00255 17th percentileScored 2026-11-07
Fix Fixed srvx (h3js): 0.11.13srvx (npm): 0.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
h3jssrvxbefore 0.11.130.11.13Patch availableCNA
—srvx (npm)before 0.11.130.11.13Patch availableGHSA-p36q-q72m-gchr
  • srvx Vendorh3js Affected before 0.11.13 Fixed in 0.11.13 Patch available CNA
  • srvx (npm) Vendor— Affected before 0.11.13 Fixed in 0.11.13 Patch available GHSA-p36q-q72m-gchr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:h3:srvx:*:*:*:*:*:node.js:*:*before 0.11.13Vulnerableh3js
  • cpe:2.3:a:h3:srvx:*:*:*:*:*:node.js:*:* Versions before 0.11.13 Vulnerable ·h3js

Remediation

  • Fix · CNA srvx (h3js) Fixed in 0.11.13
  • Fix · GHSA-p36q-q72m-gchr srvx (npm) Fixed in 0.11.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33732
  2. 2026-10-03 Alias added: GHSA-p36q-q72m-gchr

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences