CVE-2026-25938: FUXA Unauthenticated Remote Code Execution Vulnerability
Summary
CVE-2026-25938: FUXA Unauthenticated Remote Code Execution in Node-RED Integration. Affects fuxa-server versions >= 1.2.8, < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is a server application that integrates with Node-RED, a popular flow-based programming tool for wiring together hardware devices, APIs, and online services. FUXA allows users to create and manage flows, enabling automation and control of various systems. However, a critical vulnerability exists in versions 1.2.8 to 1.2.10 that allows unauthenticated remote code execution when the Node-RED plugin is enabled.
Vulnerability Detail
An authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This affects all deployments with the Node-RED plugin enabled, even if runtime.settings.secureEnabled is set to true. Attackers can exploit this vulnerability by sending specially crafted requests to the '/nodered/flows' endpoint, bypassing authentication checks and gaining administrative access to the Node-RED deployment API. This can lead to full system compromise and expose connected ICS/SCADA environments to further attacks.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.11
This is the first release that contains the fix.
npm install fuxa-server@1.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the Node-RED plugin until they can update to the patched version. This can be done by modifying the configuration settings in the FUXA application to prevent unauthorized access.
Conclusion
The CVE-2026-25938 vulnerability poses a significant risk to FUXA users with the Node-RED plugin enabled, allowing for unauthenticated remote code execution. It is crucial for users to update to the patched version 1.2.11 to protect their systems from potential exploitation.
See every vulnerability recorded for fuxa-server →
FAQ
CVE-2026-25938 is a critical vulnerability in FUXA that allows unauthenticated remote code execution when the Node-RED plugin is enabled.
FUXA versions 1.2.8 through 1.2.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 9.5, indicating a critical level of severity.
If you cannot update immediately, consider disabling the Node-RED plugin as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
