CVE-2026-25938: FUXA Unauthenticated Remote Code Execution in Node-RED Integration

February 10, 2026

Description An authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This affects FUXA version 1.2.8 through version 1.2.10. This has been patched in FUXA version 1.2.11.

References

github.com/advisories/GHSA-v4p5-w6r3-2x4f
github.com/frangoteam/FUXA
github.com/frangoteam/FUXA/commit/5e7679b09718534e4501a146fdfe093da29af336
github.com/frangoteam/FUXA/releases/tag/v1.2.11
github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f
nvd.nist.gov/vuln/detail/CVE-2026-25938

Code Behaviors & Features

Detect and mitigate CVE-2026-25938 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →