CVE-2026-43945: 
JavaScript vulnerability analysis and mitigation

CVE-2026-43945 is a pre-authentication Remote Code Execution (RCE) vulnerability in FUXA, an open-source SCADA/HMI web application, caused by a path confusion flaw in its authentication middleware. It affects npm package @frangoteam/fuxa versions >= 1.2.11 and < 1.3.1, and was first published on May 19, 2026, with the GitHub Advisory Database entry updated on May 26, 2026. The vulnerability is exploitable even when FUXA is configured in its most secure state (Secure Mode and Node-RED Secure Auth both enabled). It carries a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, FUXA Advisory).

The root cause is the authentication middleware's use of req.originalUrl — which includes query parameters — for security-critical routing decisions, classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-284 (Improper Access Control), CWE-863 (Incorrect Authorization), and CWE-94 (Code Injection). The vulnerable logic performs a substring match (url.includes('/socket.io')) on the full URL, meaning an attacker can append ?x=/socket.io to any protected administrative request to trick the middleware into treating it as a public WebSocket handshake and skipping all authentication checks. This grants unauthenticated access to /nodered/* endpoints, and if Node-RED is configured with privileged or command-execution capable nodes, arbitrary code execution as root within the container context becomes possible. The fix requires using req.path (which Express pre-parses to strip query strings) or a formal URL parser for security checks (GitHub Advisory, FUXA Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code as root within the FUXA container, achieving full compromise of the SCADA/HMI server. An attacker can intercept or manipulate industrial protocol data (MQTT, OPC-UA), alter PLC tags, and potentially pivot into the internal OT/ICS network, posing significant risk to operational technology environments. Confidentiality, integrity, and availability of the vulnerable system are all fully impacted (GitHub Advisory, FUXA Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running versions >= 1.2.11 and < 1.3.1 using tools like Shodan, Censys, or network scanning. Confirm Node-RED is enabled by checking for accessible /nodered/ endpoints.
2. Craft bypass request: Construct an HTTP request targeting a protected Node-RED administrative endpoint (e.g., /nodered/flows) and append ?x=/socket.io to the URL, exploiting the substring match flaw in the authentication middleware.
3. Bypass authentication: The middleware evaluates req.originalUrl.includes('/socket.io'), which returns true due to the appended query parameter, causing it to call next() and skip all secureEnabled and nodeRedAuthMode checks entirely.
4. Access Node-RED admin interface: With authentication bypassed, interact with the Node-RED administrative API to enumerate installed nodes and identify command-execution capable nodes (e.g., exec nodes or custom function nodes).
5. Achieve RCE: Deploy or modify a Node-RED flow containing a command-execution node (e.g., an exec node) configured to run arbitrary OS commands, then trigger the flow via the API to execute code as root within the FUXA container.
6. Post-exploitation: Establish persistence (e.g., reverse shell, cron job), exfiltrate industrial data (MQTT/OPC-UA), manipulate PLC tags, or pivot into the internal OT network (GitHub Advisory, FUXA Advisory).

• Network: HTTP requests to /nodered/* endpoints (e.g., /nodered/flows, /nodered/nodes) containing ?x=/socket.io or similar query parameter manipulation in server access logs; unexpected outbound connections from the FUXA container to external IPs.
• Logs: FUXA/Node-RED access logs showing unauthenticated access to /nodered/ administrative endpoints; requests with query strings containing /socket.io on non-WebSocket paths; Node-RED flow deployment events from unknown or unexpected sources.
• File System: New or modified Node-RED flow files (typically flows.json) containing exec nodes or function nodes with shell commands; unexpected scripts or binaries written to the container filesystem.
• Process: Unusual child processes spawned by the Node-RED or FUXA process (e.g., /bin/sh, bash, curl, wget, python); new cron jobs or persistent processes created under the root account within the container (GitHub Advisory).

Upgrade FUXA to version 1.3.1 or later, which fixes the authentication bypass by replacing the vulnerable substring URL match with a proper path-only check using req.path (FUXA Release). As an interim workaround, apply network segmentation to restrict access to FUXA administrative interfaces and Node-RED endpoints from untrusted networks. If Node-RED is not required, disable it in the FUXA configuration to eliminate the attack surface. Additionally, disable or restrict access to command-execution capable Node-RED nodes (e.g., exec nodes) if they are not operationally necessary (GitHub Advisory, FUXA Advisory).

The vulnerability was reported by researcher ud444ng and published by the FUXA maintainer (unocelli) on May 19, 2026, with the fix included in the v1.3.1 release. The advisory was added to the GitHub Advisory Database on May 26, 2026. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory, FUXA Release).