CVE-2026-33732: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33732 is a middleware bypass vulnerability in srvx, a universal server library based on web standards, caused by a pathname parsing discrepancy in its FastURL component. It affects all srvx versions prior to 0.11.13 running on the Node.js adapter. The vulnerability was published on March 23, 2026, and is a bypass of the previously reported CVE-2026-33131. It carries a CVSS v3.1 base score of 4.8 (Moderate) (GitHub Advisory).

The root cause is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference). When Node.js receives an HTTP request with an absolute URI in the request line (e.g., GET file://hehe?/internal/run HTTP/1.1), req.url is set verbatim to the full URI. Because this string does not start with /, NodeRequestURL passes it directly to FastURL, which uses a manual parser (FastURL#getPos()) that locates the pathname by finding :// and scanning for the next /. For URIs like file://hehe?/internal/run, a ? appears before the first / after the authority, causing the manual parser to incorrectly extract /internal/run as the pathname, while the native URL API correctly parses it as pathname / with search ?/internal/run. If any middleware triggers a deopt to native URL (e.g., by accessing hostname), subsequent middleware sees a different pathname than the router matched, effectively bypassing route-based guards such as auth middleware or rate limiters. Exploitation requires sending a raw HTTP request, which is not possible from standard browsers (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass route-based middleware protections — including authentication guards and rate limiters — on Node.js deployments of srvx. This can result in unauthorized access to protected routes or internal functionality, with low confidentiality and low integrity impact. Availability is not affected, and the scope is unchanged, limiting the blast radius to the vulnerable srvx instance (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.05% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to send raw HTTP requests directly to the server (not via a browser) and depends on a specific middleware execution order that triggers a FastURL deopt (GitHub Advisory).

1. Identify target: Locate a Node.js application using srvx versions prior to 0.11.13 that has route-based middleware (e.g., authentication guards) protecting specific paths.
2. Craft raw HTTP request: Construct a raw HTTP/1.1 request with an absolute URI using a non-standard scheme and a crafted query string, such as: GET file://hehe?/internal/run HTTP/1.1 followed by a Host: target.com header.
3. Send request directly: Use a raw TCP client (e.g., netcat, curl --request-target, or a custom script) to send the crafted request directly to the server, bypassing browser restrictions on absolute URIs.
4. Trigger middleware deopt: Ensure that an earlier middleware in the chain accesses a property like hostname on the request URL, which forces FastURL to deopt to the native URL parser.
5. Bypass middleware guard: The router matches the incorrectly parsed pathname /internal/run (fast-path), but after deopt, subsequent middleware (e.g., auth guard) sees pathname /, causing the guard to not apply to the intended protected route — granting access to the protected resource (GitHub Advisory).

• Network: Inbound HTTP/1.1 requests with absolute URIs in the request line (e.g., GET file://... or GET http://evil.com?/secret HTTP/1.1) visible in raw access logs or network captures; requests targeting internal or protected paths via non-standard URI schemes.
• Logs: Server access logs showing requests with absolute URIs (containing ://) in the request path field rather than a standard relative path starting with /; unexpected successful responses (2xx) to paths that should be protected by authentication middleware.
• Process/Application: Unexpected access to protected API endpoints or internal routes without valid authentication tokens or session credentials in the same request.

Upgrade srvx to version 0.11.13 or later, which fixes the issue by modifying the FastURL constructor to deopt to the native URL parser for any input string not starting with /, ensuring consistent pathname resolution across all URI types (srvx Release, Patch Commit). No configuration-based workaround is documented; upgrading is the only recommended remediation. As a defense-in-depth measure, consider placing a reverse proxy (e.g., nginx) in front of the Node.js server that rejects or normalizes requests with absolute URIs in the request line.