# @frangoteam/fuxa (npm) vulnerabilities 6 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.3.5 (Oct 20, 2026): no advisory affects it - Newest unaffected release: 1.3.5 (Oct 20, 2026), the latest release - Weekly downloads: 1,361 - Dependents: 0 - Releases: 42 since 1.0.2 (Feb 9, 2021) - Registry: https://www.npmjs.com/package/@frangoteam/fuxa - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-43945: 1.2.11 to 1.3.0 (1.3.1 is outside it) - CVE-2025-69985: 1.0.2 to 1.2.8 (1.2.9 is outside it) - CVE-2025-69971: 1.0.2 to 1.2.11 (1.3.0 is outside it) - CVE-2023-31716: 1.0.2 to 1.1.12 (1.1.13 is outside it) - CVE-2023-33831: 1.0.2 to 1.1.13 (1.1.14 is outside it) - CVE-2021-45851: 1.0.2 to 1.1.3 (1.1.4 is outside it) ## Advisories (6) ### [CVE-2026-43945](https://cve.now/CVE-2026-43945): FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - Severity: High 8.9 - Published: Jul 21, 2026 - Affected: from 1.2.11, fixed in 1.3.1. - Fixed in 1.3.1 (released Apr 10, 2026, 102 days before disclosure). - The latest release, 1.3.5, is not affected. - 4.9% of @frangoteam/fuxa downloads last week were affected versions (51). ### [CVE-2025-69985](https://cve.now/CVE-2025-69985): FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). - Severity: Critical 9.8 - Published: Feb 24, 2026 - Affected: through 1.2.8. - Fixed in 1.2.9 (released Jan 6, 2026, 49 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.3.5, is not affected. - 33% of @frangoteam/fuxa downloads last week were affected versions (345). ### [CVE-2025-69971](https://cve.now/CVE-2025-69971): FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. - Severity: Critical 9.8 - Published: Feb 3, 2026 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Mar 6, 2026, 31 days after disclosure). - The latest release, 1.3.5, is not affected. - 37% of @frangoteam/fuxa downloads last week were affected versions (388). ### [CVE-2023-31716](https://cve.now/CVE-2023-31716): FUXA \<= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log - Severity: Unrated - Published: Sep 21, 2023 - Affected: through 1.1.12. - Fixed in 1.1.13 (released May 14, 2023, 130 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.3.5, is not affected. - 16% of @frangoteam/fuxa downloads last week were affected versions (166). ### [CVE-2023-33831](https://cve.now/CVE-2023-33831): A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary… - Severity: Unrated - Published: Sep 18, 2023 - Affected: through 1.1.13. - Fixed in 1.1.14 (released Jul 10, 2023, 70 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.3.5, is not affected. - 17% of @frangoteam/fuxa downloads last week were affected versions (173). ### [CVE-2021-45851](https://cve.now/CVE-2021-45851): A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the… - Severity: Unrated - Published: Mar 16, 2022 - Affected: through 1.1.3. - Fixed in 1.1.4 (released Jan 1, 2022, 74 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.3.5, is not affected. - 6.7% of @frangoteam/fuxa downloads last week were affected versions (69). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@frangoteam/fuxa Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.