CVE-2026-33732

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr	Mitigation Vendor Advisory
https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa	Patch
https://github.com/h3js/srvx/releases/tag/v0.11.13	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:h3:srvx:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-03-26 18:16

Updated : 2026-06-17 10:38

NVD link : CVE-2026-33732

Mitre link : CVE-2026-33732

CVE.ORG link : CVE-2026-33732

JSON object : View

Products Affected

h3

srvx

CWE

CWE-706

Use of Incorrectly-Resolved Name or Reference

{"id": "CVE-2026-33732", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33732", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T14:41:02.997076Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "h3js", "product": "srvx", "versions": [{"status": "affected", "version": "< 0.11.13"}]}]}], "published": "2026-03-26T18:16:31.430", "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-p36q-q72m-gchr", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/h3js/srvx/commit/de0d69901c357f36a39b7e13eebef6c930652baa", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/h3js/srvx/releases/tag/v0.11.13", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-706"}]}], "descriptions": [{"lang": "en", "value": "srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution."}, {"lang": "es", "value": "srvx es un servidor universal basado en est\u00e1ndares web. Antes de la versi\u00f3n 0.11.13, una discrepancia en el an\u00e1lisis de rutas en el 'FastURL' de srvx permite la omisi\u00f3n de middleware en el adaptador de Node.js cuando una solicitud HTTP sin procesar utiliza una URI absoluta con un esquema no est\u00e1ndar (por ejemplo, 'file://'). A partir de la versi\u00f3n 0.11.13, el constructor 'FastURL' ahora recurre a la 'URL' nativa para cualquier cadena que no comience con '/', asegurando una resoluci\u00f3n de rutas consistente."}], "lastModified": "2026-06-17T10:38:00.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:h3:srvx:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B8FAD178-5888-4A2F-B296-86871B71B721", "versionEndExcluding": "0.11.13"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}