Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@frangoteam/fuxa

6 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
1.3.5 (Oct 20, 2026): no advisory affects it
Newest unaffected release
1.3.5 (Oct 20, 2026), the latest release
Advisories
6 · 2 critical, 1 high
Weekly downloads
1,361
Dependents
0
Releases
42 since 1.0.2 (Feb 9, 2021)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

    Affected: from 1.2.11, fixed in 1.3.1.

    Fixed in 1.3.1 (released Apr 10, 2026, 102 days before disclosure).

    The latest release, 1.3.5, is not affected.

    4.9% of @frangoteam/fuxa downloads last week were affected versions (51).

  • CVE-2025-69985Critical 9.8

    FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).

    Affected: through 1.2.8.

    Fixed in 1.2.9 (released Jan 6, 2026, 49 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.3.5, is not affected.

    33% of @frangoteam/fuxa downloads last week were affected versions (345).

  • CVE-2025-69971Critical 9.8

    FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.

    Affected: fixed in 1.3.0.

    Fixed in 1.3.0 (released Mar 6, 2026, 31 days after disclosure).

    The latest release, 1.3.5, is not affected.

    37% of @frangoteam/fuxa downloads last week were affected versions (388).

  • FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log

    Affected: through 1.1.12.

    Fixed in 1.1.13 (released May 14, 2023, 130 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.3.5, is not affected.

    16% of @frangoteam/fuxa downloads last week were affected versions (166).

  • A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary…

    Affected: through 1.1.13.

    Fixed in 1.1.14 (released Jul 10, 2023, 70 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.3.5, is not affected.

    17% of @frangoteam/fuxa downloads last week were affected versions (173).

  • A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the…

    Affected: through 1.1.3.

    Fixed in 1.1.4 (released Jan 1, 2022, 74 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.3.5, is not affected.

    6.7% of @frangoteam/fuxa downloads last week were affected versions (69).