Digest · Wednesday

Security digest: February 4, 2026

15 critical advisories.

Take stock

npm: 12 critical advisories (fuxa-server, n8n, survey-pdf). Check with npm audit (or: npm ls <package>).
Go: 2 critical advisories (github.com/rancher/local-path-provisioner, github.com/alist-org/alist/v3). Check with govulncheck ./....
PyPI: 1 critical advisory (epyt-flow). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 15

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 12

Check: npm audit (or: npm ls <package>)

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting CVE-2026-25893 CVSS 10.0 Critical
fuxa-server <= 1.2.9 → fixed in 1.2.10
n8n Merge Node has Arbitrary File Write leading to RCE CVE-2026-25056 CVSS 9.4 Critical
n8n < 1.118.0 → fixed in 1.118.0; n8n >= 2.0.0, < 2.4.0 → fixed in 2.4.0
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability CVE-2026-25630 CVSS 9.2 Critical
survey-pdf <= 1.12.58 → fixed in 1.12.59; survey-pdf >= 2.0.0, <= 2.5.4 → fixed in 2.5.5
FUXA Unauthenticated Remote Arbitrary Device Tag Write CVE-2026-25752 CVSS 9.3 Critical
fuxa-server <= 1.2.9 → fixed in 1.2.10
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users CVE-2026-25052 CVSS 9.4 Critical
n8n >= 2.0.0, < 2.5.0 → fixed in 2.5.0; n8n < 1.123.18 → fixed in 1.123.18
FUXA Unauthenticated Exposure of Plaintext Database Credentials CVE-2026-25751 CVSS 9.1 Critical
fuxa-server <= 1.2.9 → fixed in 1.2.10
n8n has OS Command Injection in Git Node CVE-2026-25053 CVSS 9.4 Critical
n8n >= 2.0.0, < 2.5.0 → fixed in 2.5.0; n8n < 1.123.10 → fixed in 1.123.10
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API CVE-2026-25895 CVSS 9.5 Critical
fuxa-server <= 1.2.9 → fixed in 1.2.10
n8n has a Python sandbox escape CVE-2026-25115 CVSS 9.4 Critical
n8n < 2.4.8 → fixed in 2.4.8
n8n Vulnerable to Command Injection in Community Package Installation CVE-2026-21893 CVSS 9.4 Critical
n8n >= 0.187.0, < 1.120.3 → fixed in 1.120.3
n8n Has Expression Escape Vulnerability Leading to RCE CVE-2026-25049 CVSS 9.4 Critical
n8n < 1.123.17 → fixed in 1.123.17; n8n >= 2.0.0, < 2.5.2 → fixed in 2.5.2
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration CVE-2026-25894 CVSS 9.5 Critical
fuxa-server <= 1.2.9 → fixed in 1.2.10

Go 2

Check: govulncheck ./...

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern CVE-2025-62878 CVSS 9.9 Critical
github.com/rancher/local-path-provisioner < 0.0.34 → fixed in 0.0.34
Alist has Insecure TLS Config CVE-2026-25160 CVSS 9.1 Critical
github.com/alist-org/alist/v3 < 3.57.0 → fixed in 3.57.0

PyPI 1

Check: pip-audit (or: pip show <package>)

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) CVE-2026-25632 CVSS 10.0 Critical
epyt-flow < 0.16.1 → fixed in 0.16.1