CVE-2026-47719: FUXA Unauthenticated SSRF Vulnerability in fuxa-server
Summary
CVE-2026-47719: An unauthenticated attacker (Alice) connects to FUXA's Socket.IO endpoint and emits a device-webapi-request event whose property.address field names an arbitrary URL. Affects fuxa-server versions < 1.1.14-1243. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FUXA is an open-source server designed for managing and controlling IoT devices through a Socket.IO interface. It allows users to interact with various devices and services seamlessly. However, the server has a critical vulnerability that exposes it to unauthenticated Server-Side Request Forgery (SSRF) attacks, enabling attackers to exploit the system and access sensitive internal resources.
Vulnerability Detail
The vulnerability arises from the lack of authorization checks in the Socket.IO event handlers, specifically DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY. An unauthenticated attacker can connect to the Socket.IO endpoint and send requests that allow them to read arbitrary URLs, including internal services and cloud instance metadata. This can lead to significant data exposure and unauthorized access to sensitive systems, as the attacker can receive the full response body of the requests made by the server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Socket.IO endpoint by implementing network-level controls or firewall rules to limit connections to trusted sources until the vulnerability is patched.
Conclusion
The CVE-2026-47719 vulnerability in the fuxa-server package poses a significant risk due to its potential for unauthorized access to sensitive internal resources. It is crucial to apply the recommended fixes and stay updated with the latest versions to mitigate this risk effectively.
See every vulnerability recorded for fuxa-server →
FAQ
CVE-2026-47719 is a vulnerability in the fuxa-server package that allows unauthenticated attackers to exploit Server-Side Request Forgery (SSRF) through Socket.IO events.
An attacker can use this vulnerability to access internal services, read sensitive data, and potentially compromise the security of your system.
Yes, the patch is available in version 1.3.2 of the fuxa-server package. It is recommended to update to this version or later.
Update the fuxa-server package to the latest version, implement the recommended code changes, and consider applying network-level restrictions as a temporary measure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
