# fuxa-server (npm) vulnerabilities 21 known vulnerabilities (8 critical, 7 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.1.14-1243 (Jul 10, 2023): affected by 12 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 39 - Dependents: 0 - Releases: 1 since 1.1.14-1243 (Jul 10, 2023) - Registry: https://www.npmjs.com/package/fuxa-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-47721: 1.1.14-1243 (through the newest release) - CVE-2026-47719: 1.1.14-1243 (through the newest release) - CVE-2026-47720: 1.1.14-1243 (through the newest release) - CVE-2026-47718: no published release is affected - CVE-2026-47717: no published release is affected - CVE-2026-43947: no published release is affected - CVE-2026-43946: no published release is affected - CVE-2026-25895: 1.1.14-1243 (through the newest release) - CVE-2026-25894: 1.1.14-1243 (through the newest release) - CVE-2026-25893: 1.1.14-1243 (through the newest release) - CVE-2026-25951: 1.1.14-1243 (through the newest release) - CVE-2026-25939: no published release is affected - CVE-2026-25938: no published release is affected - CVE-2026-25751: 1.1.14-1243 (through the newest release) - CVE-2026-25752: 1.1.14-1243 (through the newest release) - CVE-2025-69983: 1.1.14-1243 (through the newest release) - CVE-2025-69981: 1.1.14-1243 (through the newest release) - CVE-2025-69970: 1.1.14-1243 (through the newest release) - CVE-2023-31719: no published release is affected - CVE-2023-31718: no published release is affected - CVE-2023-31717: no published release is affected ## Advisories (21) ### [CVE-2026-47721](https://cve.now/CVE-2026-47721): FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions - Severity: Medium 6.3 - Published: Aug 18, 2026 - Affected: through 1.1.14-1243. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-47719](https://cve.now/CVE-2026-47719): FUXA: Unauthenticated SSRF via Socket.IO DEVICE\_WEBAPI\_REQUEST and DEVICE\_PROPERTY with response reading - Severity: High 8.2 - Published: Aug 18, 2026 - Affected: through 1.1.14-1243. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-47720](https://cve.now/CVE-2026-47720): FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: through 1.1.14-1243. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-47718](https://cve.now/CVE-2026-47718): FUXA provides guest and invalid-token access to protected read APIs in secure mode - Severity: Medium 5.5 - Published: Aug 12, 2026 - Affected: from 1.3.0-2773, fixed in 1.3.1. - No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-47717](https://cve.now/CVE-2026-47717): FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations - Severity: High 7.5 - Published: Aug 12, 2026 - Affected: from 1.3.0, fixed in 1.3.1. - No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-43947](https://cve.now/CVE-2026-43947): FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass - Severity: High 8.9 - Published: Jul 21, 2026 - Affected: from 1.3.0, fixed in 1.3.1. - No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-43946](https://cve.now/CVE-2026-43946): FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue - Severity: High 7.7 - Published: Jul 21, 2026 - Affected: from 1.3.0, fixed in 1.3.1. - No fix released. The advisory names 1.3.1 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-25895](https://cve.now/CVE-2026-25895): FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API - Severity: Critical 9.5 - Published: Feb 9, 2026 - Affected: fixed in 1.2.10. - No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-25894](https://cve.now/CVE-2026-25894): FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration - Severity: Critical 9.5 - Published: Feb 9, 2026 - Affected: fixed in 1.2.10. - No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-25893](https://cve.now/CVE-2026-25893): FUXA Unauthenticated Remote Code Execution via Admin JWT Minting - Severity: Critical 10.0 - Published: Feb 9, 2026 - Affected: fixed in 1.2.10. - No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-25951](https://cve.now/CVE-2026-25951): FUXA has a Path Traversal Sanitization Bypass - Severity: High 8.6 - Published: Feb 9, 2026 - Affected: fixed in 1.2.11. - No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-25939](https://cve.now/CVE-2026-25939): FUXA Unauthenticated Remote Arbitrary Scheduler Write - Severity: Critical 9.3 - Published: Feb 9, 2026 - Affected: from 1.2.8, fixed in 1.2.11. - No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-25938](https://cve.now/CVE-2026-25938): FUXA Unauthenticated Remote Code Execution in Node-RED Integration - Severity: Critical 9.5 - Published: Feb 9, 2026 - Affected: from 1.2.8, fixed in 1.2.11. - No fix released. The advisory names 1.2.11 as the fix, which the registry doesn't have yet. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2026-25751](https://cve.now/CVE-2026-25751): FUXA Unauthenticated Exposure of Plaintext Database Credentials - Severity: Critical 9.1 - Published: Feb 6, 2026 - Affected: fixed in 1.2.10. - No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2026-25752](https://cve.now/CVE-2026-25752): FUXA Unauthenticated Remote Arbitrary Device Tag Write - Severity: Critical 9.3 - Published: Feb 6, 2026 - Affected: fixed in 1.2.10. - No fix released. The advisory names 1.2.10 as the fix, which the registry doesn't have yet. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2025-69983](https://cve.now/CVE-2025-69983): FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. - Severity: High 8.2 - Published: Feb 3, 2026 - Affected: through 1.2.7. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2025-69981](https://cve.now/CVE-2025-69981): FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the \`/api/upload\` API endpoint. - Severity: High 7.5 - Published: Feb 3, 2026 - Affected: through 1.2.7. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2025-69970](https://cve.now/CVE-2025-69970): FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. - Severity: Critical 9.3 - Published: Feb 3, 2026 - Affected: through 1.2.7. - No fix released. The latest release, 1.1.14-1243, is still affected. - 100% of fuxa-server downloads last week were affected versions (27). ### [CVE-2023-31719](https://cve.now/CVE-2023-31719): FUXA \<= 1.1.12 is vulnerable to SQL Injection via /api/signin. - Severity: Unrated - Published: Sep 21, 2023 - Affected: through 1.1.12. - No fix released. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2023-31718](https://cve.now/CVE-2023-31718): FUXA \<= 1.1.12 is vulnerable to Local via Inclusion via /api/download. - Severity: Unrated - Published: Sep 21, 2023 - Affected: through 1.1.12. - No fix released. - 0% of fuxa-server downloads last week were affected versions (0). ### [CVE-2023-31717](https://cve.now/CVE-2023-31717): A SQL Injection attack in FUXA \<= 1.1.12 allows exfiltration of confidential information from the database. - Severity: Unrated - Published: Sep 21, 2023 - Affected: through 1.1.12. - No fix released. - 0% of fuxa-server downloads last week were affected versions (0). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/fuxa-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.