CVE-2026-33732CWE-706

srvx is vulnerable to middleware bypass via absolute URI in request line

Medium · published March 26, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's `FastURL` allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. `file://`). Starting in version 0.11.13, the `FastURL` constructor now deopts to native `URL` for any string not starting with `/`, ensuring consistent pathname resolution.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-03-26T17:21Z
EPSS history
Timeline
  • 26 MAR 17:21Z
    srvx is vulnerable to middleware bypass via absolute URI in request line
    cvelistv5