Middleware Bypass Vulnerability in srvx Server from h3js

CVE-2026-33732

What is CVE-2026-33732?

srvx, a universal server based on web standards, has a vulnerability due to a pathname parsing issue in its FastURL mechanism. This flaw allows for middleware bypass when using an absolute URI with a non-standard scheme, such as 'file://'. The vulnerability is resolved in version 0.11.13, where the FastURL constructor now correctly deopts to the native URL for any strings that do not start with a '/'. This correction ensures consistent pathname resolution and helps secure the server against potential exploits.

References