@100x/application (>=0.0.1, <=0.0.6), @abysslabs/cli (>=0.0.1, <=0.0.2) +266 more potentially affected by CVE-2026-33131 +1 more via srvx (>=0.1.4, <=0.11.12)

srvx NPM version =0.1.4, =0.0.1, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =1.0.0, =2.4.0-alpha.2, =2.4.0-alpha.2, =0.3.7, =0.3.10 and more Source cves: CVE-2026-33131, CVE-2026-33732 Source advisory: SNYK:JS-SRVX-15790571...

GHSA-P36Q-Q72M-GCHR srvx is vulnerable to middleware bypass via absolute URI in request line

Summary A pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme e.g. file://. Details When Node.js receives an absolute URI in the request line e.g. GET file://hehe?/internal/run...

@100x/application (>=0.0.1, <=0.0.6), @abysslabs/cli (0.0.2) +111 more potentially affected by CVE-2026-33131 via h3 (>=2.0.0, <=2.0.1-rc.14)

h3 NPM version =2.0.0, =0.0.1, =0.4.2, =0.1.0, =0.1.1, =0.1.3, =0.2.0, =0.1.0-beta.0, =0.1.0-beta.0, =0.1.0-beta.0, =0.1.0-beta.0, =0.1.0-beta.0, =0.1.0-beta.0, =0.1.0-beta.105 and more Source cves: CVE-2026-33131 Source advisory: MEND:CVE-2026-33131...

CVE-2026-33131

creationtimestamp| type| source ---|---|--- 2026-03-17 11:50:55+00:00| published-proof-of-concept| https://github.com/h3js/h3/security/advisories/GHSA-3vj8-jmxq-cgj5 2026-03-20 13:53:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhio42zzri2u 2026-03-20 21:40:09+00:00| seen|...