CVE-2025-69985: FUXA Authentication Bypass via HTTP Referer Header Spoofing
Summary
CVE-2025-69985: FUXA has JWT Authentication Bypass via HTTP Referer header spoofing. Affects @frangoteam/fuxa versions < 1.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source Node.js package designed for executing scripts securely through a web interface. It allows users to run Node.js code remotely, providing a convenient way to manage and execute scripts. However, versions 1.2.8 and earlier are vulnerable to a critical authentication bypass issue that can lead to unauthorized access and remote code execution.
Vulnerability Detail
The vulnerability arises from the server/api/jwt-helper.js middleware, which improperly trusts the HTTP 'Referer' header for validating internal requests. This flaw allows a remote unauthenticated attacker to spoof the Referer header to match the server's host, bypassing JWT authentication. Successful exploitation grants access to the protected /api/runscript endpoint, enabling the attacker to execute arbitrary Node.js code on the server, potentially leading to severe consequences such as data breaches or complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks on the server-side to ensure that requests are authenticated properly, regardless of the Referer header. This may involve using alternative methods for authentication or implementing stricter access controls.
Conclusion
The FUXA package versions 1.2.8 and earlier are vulnerable to a critical authentication bypass flaw that can lead to remote code execution. It is crucial to update to version 1.2.9 or later to mitigate this risk. Additionally, consider implementing temporary workarounds until the update can be applied.
See every vulnerability recorded for @frangoteam/fuxa →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, remote code execution, data breaches, and complete system compromise.
Yes, a patch is available in version 1.2.9 of the FUXA package. It is recommended to update to this version or later.
If an immediate update is not possible, implement additional server-side validation checks as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for @frangoteam/fuxa.
