# @haxtheweb/haxcms-nodejs (npm) vulnerabilities 16 known vulnerabilities (4 critical, 9 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 26.8.1 (Aug 14, 2026): no advisory affects it - Newest unaffected release: 26.8.1 (Aug 14, 2026), the latest release - Weekly downloads: 983 - Dependents: 4 - Releases: 61 since 0.0.2 (Jun 17, 2024) - Registry: https://www.npmjs.com/package/@haxtheweb/haxcms-nodejs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-46357: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-46496: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-46396: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-46511: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-46395: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-46393: 0.0.2 to 25.0.0 (26.0.0 is outside it) - CVE-2026-48527: 0.0.2 to 26.0.0 (26.0.1 is outside it) - CVE-2026-22704: 11.0.6 to 11.0.15 (25.0.0 is outside it) - CVE-2025-54378: 0.0.2 to 11.0.13 (11.0.14 is outside it) - CVE-2025-54139: 0.0.2 to 11.0.12 (11.0.13 is outside it) - CVE-2025-54137: 0.0.2 to 11.0.9 (11.0.10 is outside it) - CVE-2025-54134: 0.0.2 to 11.0.8 (11.0.9 is outside it) - CVE-2025-54128: 0.0.2 to 11.0.7 (11.0.8 is outside it) - CVE-2025-54127: 0.0.2 to 11.0.6 (11.0.7 is outside it) - CVE-2025-49141: 0.0.2 to 11.0.2 (11.0.3 is outside it) - CVE-2025-49139: 0.0.2 to 10.0.6 (11.0.0 is outside it) ## Advisories (16) ### [CVE-2026-46357](https://cve.now/CVE-2026-46357): HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request - Severity: Medium 6.5 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-46496](https://cve.now/CVE-2026-46496): HAX CMS: Stored XSS via '\' component allows arbitrary JavaScript execution and token theft - Severity: Critical 9.3 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-46396](https://cve.now/CVE-2026-46396): HAX CMS has a stored XSS via \ that allows access to sensitive client-side data and account takeover - Severity: Critical 9.3 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-46511](https://cve.now/CVE-2026-46511): HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack - Severity: High 8.7 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-46395](https://cve.now/CVE-2026-46395): HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation - Severity: Critical 9.3 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-46393](https://cve.now/CVE-2026-46393): HAXcms createSite SSRF Enables Arbitrary File Read - Severity: High 7.1 - Published: Jun 5, 2026 - Affected: fixed in 26.0.0. - Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure). - The latest release, 26.8.1, is not affected. - 67% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-48527](https://cve.now/CVE-2026-48527): HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint - Severity: High 8.7 - Published: May 29, 2026 - Affected: fixed in 26.0.1. - Fixed in 26.0.1 (released May 21, 2026, 8 days before disclosure). - The latest release, 26.8.1, is not affected. - 68% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.3K). ### [CVE-2026-22704](https://cve.now/CVE-2026-22704): HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover - Severity: High 8.1 - Published: Jan 10, 2026 - Affected: from 11.0.6, fixed in 25.0.0. - Fixed in 25.0.0 (released Jan 9, 2026, 1 day before disclosure). - The latest release, 26.8.1, is not affected. - 14% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (273). ### [CVE-2025-54378](https://cve.now/CVE-2025-54378): HAX CMS Backend Lacks Comprehensive Authorization Checks - Severity: High 8.3 - Published: Jul 26, 2025 - Affected: fixed in 11.0.14. - Fixed in 11.0.14 (released Jul 23, 2025, 3 days before disclosure). - The latest release, 26.8.1, is not affected. - 62% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.2K). ### [CVE-2025-54139](https://cve.now/CVE-2025-54139): HAX CMS' application pages are vulnerable to clickjacking - Severity: Medium 4.3 - Published: Jul 22, 2025 - Affected: fixed in 11.0.13. - Fixed in 11.0.13 (released Jul 21, 2025, 1 day before disclosure). - The latest release, 26.8.1, is not affected. - 60% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.1K). ### [CVE-2025-54137](https://cve.now/CVE-2025-54137): NodeJS version of the HAX CMS application is distributed with Default Secrets - Severity: High 7.3 - Published: Jul 22, 2025 - Affected: fixed in 11.0.10. - Fixed in 11.0.10 (released Jul 21, 2025, 1 day before disclosure). - The latest release, 26.8.1, is not affected. - 57% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1.1K). ### [CVE-2025-54134](https://cve.now/CVE-2025-54134): HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service - Severity: High 7.1 - Published: Jul 21, 2025 - Affected: fixed in 11.0.9. - Fixed in 11.0.9 (released Jul 21, 2025, the day of disclosure). - The latest release, 26.8.1, is not affected. - 55% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1K). ### [CVE-2025-54128](https://cve.now/CVE-2025-54128): HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting - Severity: High 7.2 - Published: Jul 21, 2025 - Affected: fixed in 11.0.8. - Fixed in 11.0.8 (released Jul 21, 2025, the day of disclosure). - The latest release, 26.8.1, is not affected. - 54% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (1K). ### [CVE-2025-54127](https://cve.now/CVE-2025-54127): HAXcms's Insecure Default Configuration Leads to Unauthenticated Access - Severity: Critical 9.3 - Published: Jul 21, 2025 - Affected: fixed in 11.0.7. - Fixed in 11.0.7 (released Jul 21, 2025, the day of disclosure). - The latest release, 26.8.1, is not affected. - 52% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (988). ### [CVE-2025-49141](https://cve.now/CVE-2025-49141): HaxCMS-PHP Command Injection Vulnerability - Severity: High 8.6 - Published: Jun 9, 2025 - Affected: fixed in 11.0.3. - Fixed in 11.0.3 (released Jun 9, 2025, the day of disclosure). - The latest release, 26.8.1, is not affected. - 47% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (895). ### [CVE-2025-49139](https://cve.now/CVE-2025-49139): @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability - Severity: Medium 5.3 - Published: Jun 9, 2025 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released Jun 6, 2025, 3 days before disclosure). - The latest release, 26.8.1, is not affected. - 44% of @haxtheweb/haxcms-nodejs downloads last week were affected versions (825). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@haxtheweb/haxcms-nodejs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.