Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@frangoteam/fuxa

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.9npmAmendedPublished

    FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

    CVE-2026-43945 · GHSA-p69w-mmfv-xrfj

    Affected
    • npm @frangoteam/fuxa >= 1.2.11, < 1.3.1
    Fixed in
    1.3.1· Vendor fix available
    Issue
    Pre-auth RCE in FUXA via Logic Bypass Summary A Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that allows an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Details The vulnerability is a Path Confusion flaw in the authentication middleware. The server uses a substring match on the full URL (including query parameters) to exclude certain paths from authentication. Involved Logic: JavaScript: Proof of Concept A specially crafted request containing manipulated query parameters could bypass authentication checks on protected /nodered/ endpoints. In configurations where Node-RED exposed privileged or command-execution capable nodes, this could lead to remote code execution within the container context. Impact Access Level: Unauthenticated / Remote. Privilege Level: Access to Node-RED administrative…

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. High, CVSS 8.1npmAmendedPublished

    FUXA has a hardcoded fallback JWT signing secret

    CVE-2025-69971 · GHSA-c8m8-3jcr-6rj5

    Affected
    • npm @frangoteam/fuxa <= 1.2.11
    Fixed in
    1.3.0· Vendor fix available
    Issue
    FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured. If authentication was enabled without explicitly setting a custom secret, an attacker who knew the default value could forge valid JWT tokens and bypass authentication. This issue has been addressed in version 1.3.0 by removing the static fallback and generating a secure random secret when no secretCode is provided.

    Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →