h3js srvx vulnerabilities

Latest h3js srvx CVEs

Newest publication first

1. CVE-2026-33732 srvx is vulnerable to middleware bypass via absolute URI in request line

   Published 2026-03-26

   Medium·CVSS 6.5 EPSS 0.26%

   srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme (e.g. file://). Starting in versio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.