FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Description

Pre-auth RCE in FUXA via Logic Bypass

Summary

A Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that allows an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled).

Recommendation

Update the @frangoteam/fuxa package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.2.11, < 1.3.1
• Patched version(s): 1.3.1

References

• GHSA-p69w-mmfv-xrfj
• CVE-2026-43945
• CWE-284
• CWE-288
• CWE-863
• CWE-94
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975
• i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

@frangoteam/fuxa