Platform
nodejs
Component
fuxa-server
Fixed in
1.2.9
1.2.11
CVE-2026-25938 describes a critical Remote Code Execution (RCE) vulnerability affecting fuxa-server. This flaw allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. The vulnerability impacts versions 1.2.8 through 1.2.10 and has been resolved in version 1.2.11.
The impact of CVE-2026-25938 is severe. An attacker can bypass authentication checks by sending a specially crafted request to the /nodered/flows endpoint. Successful exploitation grants the attacker complete control over the affected fuxa-server, enabling them to execute arbitrary code, steal sensitive data, modify system configurations, or potentially pivot to other systems within the network. The vulnerability affects all deployments with the Node-RED plugin enabled, even those with security settings like runtime.settings.secureEnabled enabled, indicating a broad attack surface.
CVE-2026-25938 was publicly disclosed on 2026-02-10. The vulnerability's ease of exploitation and the potential for significant impact suggest a medium to high probability of exploitation. No public proof-of-concept (POC) code has been publicly released as of this writing, but the vulnerability's nature makes it likely that a POC will emerge. It is not currently listed on CISA KEV.
Exploit Status
EPSS
0.14% (34% percentile)
CISA SSVC
The primary mitigation for CVE-2026-25938 is to immediately upgrade fuxa-server to version 1.2.11 or later. If upgrading is not immediately feasible, consider disabling the Node-RED plugin entirely as a temporary workaround. While a WAF might offer some protection, it's unlikely to be effective against a crafted request designed to bypass authentication. Monitor access logs for unusual activity targeting the /nodered/flows endpoint. Review and harden Node-RED plugin configurations to minimize potential attack vectors.
Actualice FUXA a la versión 1.2.11 o superior. Esta versión contiene la corrección para la vulnerabilidad de ejecución remota de código. La actualización se puede realizar a través del panel de administración de FUXA o descargando la última versión desde el sitio web del proveedor.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25938 is a critical Remote Code Execution vulnerability in fuxa-server versions 1.2.8 through 1.2.10, allowing unauthenticated attackers to execute code.
You are affected if you are running fuxa-server version 1.2.8, 1.2.9, or 1.2.10 and have the Node-RED plugin enabled.
Upgrade fuxa-server to version 1.2.11 or later. As a temporary workaround, disable the Node-RED plugin.
While no active exploitation has been confirmed, the vulnerability's ease of exploitation suggests a potential for exploitation.
Refer to the official fuxa-server security advisories on their website or GitHub repository for the latest information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.