@haxtheweb/haxcms-nodejs (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @haxtheweb/haxcms-nodejs, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (16)

• CVE-2025-54127 — CVSS 9.8 (critical): HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS…
• CVE-2026-46395: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms…
• CVE-2026-46496: HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions…
• CVE-2026-46396: HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions…
• CVE-2026-46511: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS…
• CVE-2026-48527 — CVSS 8.7 (high): HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored…
• CVE-2025-49141 — CVSS 8.5 (high): HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality…
• CVE-2025-54378 — CVSS 8.3 (high): HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and…
• CVE-2026-22704 — CVSS 8.0 (high): HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored…
• CVE-2025-54137 — CVSS 7.3 (high): HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with…
• CVE-2026-46393: HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in…
• CVE-2026-46357 — CVSS 6.5 (medium): HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when…
• CVE-2025-54134 — CVSS 6.5 (medium): HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS…
• CVE-2025-54128 — CVSS 6.1 (medium): HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of…
• CVE-2025-49139 — CVSS 5.3 (medium): HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can…
• CVE-2025-54139 — CVSS 4.3 (medium): HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in…