CVE-2025-56647
Medium
Description
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.
SeverityMedium
CVSS6.5
Exploit probability—
Product@farmfe/core
PublishedFeb 12, 2026
First seenFeb 12, 2026
Weakness typeCWE-1385CWE-1385
How to fix
Update
- @farmfe/core1.7.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @farmfe/corenpm | v < 1.7.6 | 1.7.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.