CVE-2026-43945: @frangoteam/fuxa Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p69w-mmfv-xrfj",
  "modified" : "2026-05-26T23:40:42Z",
  "published" : "2026-05-26T23:40:42Z",
  "aliases" : [ "CVE-2026-43945" ],
  "summary" : "FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection",
  "details" : "**Pre-auth** RCE in FUXA via Logic Bypass\n\nSummary\n\nA Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that allows an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled).\n\nDetails\nThe vulnerability is a Path Confusion flaw in the authentication middleware. The server uses a substring match on the full URL (including query parameters) to exclude certain paths from authentication.\n\nInvolved Logic:\n\nJavaScript:\n```\nconst url = req.originalUrl || req.url || req.path;\nif (url.includes('/socket.io')) return next();\nBy appending ?x=/socket.io to any administrative request, the middleware is \"tricked\" into treating the request as a public WebSocket handshake, bypassing the secureEnabled and nodeRedAuthMode checks entirely.\n```\n\nProof of Concept\n\nA specially crafted request containing manipulated query parameters could bypass authentication checks on protected /nodered/* endpoints.\n\nIn configurations where Node-RED exposed privileged or command-execution capable nodes, this could lead to remote code execution within the container context.\n\nImpact\nAccess Level: Unauthenticated / Remote.\n\nPrivilege Level: Access to Node-RED administrative endpoints. \nRemote code execution may be possible depending on the Node-RED configuration and installed nodes.\n\nCVSS 3.1 Score: High severity.\n\nDescription: An attacker can gain total control over the SCADA server, allowing them to intercept industrial data (MQTT/OPC-UA), manipulate PLC tags, or pivot into the internal OT network.\n\nRoot Cause & Remediation\nThe root cause is the reliance on req.originalUrl for security-critical routing decisions.\n\nThe Fix:\nThe developer must use req.path (which Express pre-parses to remove query strings) or a formal URL parser to ensure that the security check is performed only against the pathname.\n\n```\nJavaScript\n\n// Secure approach\nconst pathname = req.path; \nif (pathname.startsWith('/socket.io/')) return next();\n```\n\nThis issue affects only setups where Node-RED is enabled.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@frangoteam/fuxa"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.2.11"
      }, {
        "fixed" : "1.3.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/frangoteam/FUXA"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284", "CWE-288", "CWE-863", "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-26T23:40:42Z",
    "nvd_published_at" : null
  }
}