CVE-2025-54127: Insecure Default Configuration in @haxtheweb/haxcms-nodejs Leading to Unauthenticated Access
Summary
CVE-2025-54127: NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access. Affects @haxtheweb/haxcms-nodejs versions < 11.0.7. Fixed in 11.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @haxtheweb/haxcms-nodejs package is a NodeJS implementation of HAX CMS, a content management system designed for web applications. It provides a flexible framework for managing content, enabling users to create, edit, and publish web content efficiently. However, the package has a critical vulnerability due to its insecure default configuration, which is intended for local development but is not suitable for production environments.
Vulnerability Detail
The vulnerability arises from the default configuration of the haxcms-nodejs package, which sets the environment variable 'HAXCMS_DISABLE_JWT_CHECKS' to 'true'. This configuration disables session authentication and authorization checks, allowing unauthenticated remote attackers to access, modify, and delete site information without any security barriers. The lack of these essential security measures poses a significant risk to the integrity and confidentiality of the deployed application.
How To Fix
Minimum fixed version
11.0.7
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@11.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can manually set the environment variable 'HAXCMS_DISABLE_JWT_CHECKS' to 'false' in your deployment configuration. This will enable JWT checks and provide a layer of security until you can apply the official patch.
Conclusion
The CVE-2025-54127 vulnerability in the @haxtheweb/haxcms-nodejs package highlights the importance of secure configurations in web applications. By updating to the latest version or implementing the suggested workaround, users can protect their applications from unauthorized access and ensure the integrity of their content management systems.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
CVE-2025-54127 is a critical vulnerability in the @haxtheweb/haxcms-nodejs package that allows unauthenticated access due to an insecure default configuration.
If your application uses the affected version of haxcms-nodejs without proper configuration, it could be exposed to unauthorized access, allowing attackers to manipulate or delete content.
You should update to version 11.0.7 or later of the @haxtheweb/haxcms-nodejs package to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Failure to address this vulnerability could lead to unauthorized access, data breaches, and potential loss of sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
