PT-2026-43445 · Npm+2 · @Frangoteam/Fuxa+1
CVE-2026-43945
·
Published
2026-05-26
·
Updated
2026-07-21
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
FUXA versions 1.2.11 through 1.3.0
Description
A path confusion flaw in the authentication middleware allows an unauthenticated remote attacker to achieve full remote code execution as root. The issue occurs because the server uses a substring match on the full URL, including query parameters, to exclude specific paths from authentication. By appending
?x=/socket.io to administrative requests, an attacker can trick the middleware into treating the request as a public WebSocket handshake, bypassing secureEnabled and nodeRedAuthMode checks. This allows unauthorized access to protected /nodered/* endpoints, which may lead to remote code execution depending on the Node-RED configuration and installed nodes. This flaw affects setups where Node-RED is enabled and persists even when the platform is configured in its most secure state.Recommendations
Update to version 1.3.1.
As a temporary mitigation, restrict access to the
/nodered/* endpoints to minimize the risk of exploitation.Exploit
Fix
RCE
Authentication Bypass Using an Alternate Path or Channel
Code Injection
Incorrect Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Frangoteam/Fuxa
Fuxa