CVE-2026-33732 srvx is vulnerable to middleware bypass via absolute URI in request line
Attackers can bypass middleware security checks in srvx by using absolute URIs with non-standard schemes in HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33732?
CVE-2026-33732 is a medium-severity vulnerability in h3js srvx, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.
Weakness: CWE-706
Which versions are affected by CVE-2026-33732?
2 open source packages ship an affected version, including srvx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
srvx npm | All versions | 0.11.13 |
srvx npm | All versions | 0.11.13 |
Products include H3 Srvx.
How do I fix CVE-2026-33732?
Upgrade srvx to 0.11.13 or later.
Is CVE-2026-33732 being exploited?
There is no known exploitation of CVE-2026-33732 in the wild and no public exploit code.
Sources
Also known as GHSA-p36q-q72m-gchr.