@farmfe/core is Missing Origin Validation in WebSocket

Description

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

Recommendation

Update the @farmfe/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.7.6
• Patched version(s): 1.7.6

References

• GHSA-p773-8mf4-rjm5
• CVE-2025-56647
• CWE-1385
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Missing Origin Validation in browserify-hmr - CVE-2018-14730
• Strapi Password Hashing is Missing Maximum Password Length Validation - CVE-2025-25298
• Missing Origin Validation in webpack-dev-server - CVE-2018-14732
• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192

Tags:

npm

@farmfe/core