srvx, a universal server built on web standards, had a pathname parsing discrepancy in its FastURL routine that allowed an attacker to bypass middleware by sending a raw HTTP request containing an absolute URI with a non‑standard scheme such as file://. This defect meant that requests could be routed without passing through the intended middleware stack, potentially exposing endpoints or actions that should have been protected. The vulnerability does not provide direct code execution, but it grants the attacker the ability to send requests to any path handled by the Node.js adapter, effectively subverting the expected request handling flow.

The issue affects the h3js srvx product, specifically all releases prior to version 0.11.13. Users running the Node.js adapter of srvx before this patch are vulnerable.

The CVSS score of 4.8 corresponds to a medium impact, and the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be able to send a crafted HTTP request to the srvx server, inserting an absolute URI with a non‑standard scheme; this is typically achievable via network access to the server. There are no publicly known exploit scripts, but the path bypass could be leveraged for privilege escalation against the application if additional sensitive logic is exposed.