Threat Investigation
Request a demo

CVE-2026-33732

Medium

Description

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

SeverityMedium
CVSS4.8
Exploit probability—
ProductH3 Srvx
PublishedMar 26, 2026
First seenMar 26, 2026
Weakness typeCWE-706CWE-706

How to fix

Update
  • h3 srvx0.11.13 or later
  • srvx0.11.13 or later

Affected products

ProductAffected versionsFixed in
h3 srvxv < 0.11.130.11.13
srvxnpmv < 0.11.130.11.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.