CVE-2025-54134 json
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
published 2025-07-21 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22263 , GHSA-pjj3-j5j6-qj27
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
Patch / fix
- npm @haxtheweb/haxcms-nodejs 11.0.9
- haxtheweb hax 11.0.9
- haxtheweb haxcms-nodejs 11.0.9
- psu haxcms-nodejs 11.0.9
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @haxtheweb/haxcms-nodejs | <11.0.9 |
11.0.9 |
Affected products
- haxtheweb issues
Classification
References
-
github.com
/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34
web, patch
-
github.com
/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27
web, third-party-advisory
-
github.com
/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22
web, product
-
github.com
/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-54134
advisory
-
github.com
/haxtheweb/haxcms-nodejs
package
Sources
- CVE List CVE-2025-54134
- GitHub Advisory GHSA-pjj3-j5j6-qj27
- NVD CVE-2025-54134
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.