Authentication bypass and remote code execution in FUXA (CVE-2026-43945)

FUXA contains a path confusion flaw in its authentication middleware that allows unauthenticated remote attackers to bypass security checks by appending `?x=/socket.io` to requests targeting protected `/nodered/*` endpoints. The middleware performs a substring match against the full URL including query parameters, causing it to incorrectly treat arbitrary authenticated endpoints as public WebSocket paths. On installations where Node-RED is enabled and exposes privileged nodes, this bypass can result in remote code execution within the container context. Affected versions: - v1.2.11 We recommend updating to: >= 1.3.1. CVSS 8.9 · our assessment: this_week Reference: https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj Details: https://vuln.today/cve/CVE-2026-43945