Medium, CVSS 4.8npmAmendedPublished
srvx is vulnerable to middleware bypass via absolute URI in request line
CVE-2026-33732 · GHSA-p36q-q72m-gchr
- Affected
- npm srvx < 0.11.13
- Fixed in
- 0.11.13· Vendor fix available
- Issue
- A pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. file://). Details When Node.js receives an absolute URI in the request line (e.g. GET file://hehe?/internal/run HTTP/1.1), req.url is set verbatim to file://hehe?/internal/run. Since this doesn't start with /, NodeRequestURL passes it directly to FastURL as a string, which stores it in #href for lazy manual parsing. FastURL#getPos() locates the pathname by finding :// then scanning for the next / — but this fails for URLs like file://hehe?/internal/run where a ? appears before the first / after the authority. The manual parser extracts pathname as /internal/run, while native URL correctly parses it as pathname / with search ?/internal/run. This discrepancy means the router (using the fast-path) matches /internal/run, but if any middleware triggers a deopt to native URL (e.g. by accessing hostname),…
Recommended action: Upgrade to 0.11.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.