6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-56647

CVE-2025-56647: @farmfe/core is Missing Origin Validation in WebSocket

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers running Farm who visit their webpage and steal source code that is leaked by the WebSocket server.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-56647

CVE-2025-56647:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@farmfe/core	npm	< 1.7.6	1.7.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @farmfe/core package's development server. Specifically, the WebSocket server used for Hot Module Replacement (HMR) did not validate the Origin header of incoming connection requests. This flaw is located in the WsServer class within packages/core/src/server/ws.ts.

The root cause is in the isHMRRequest method, which was responsible for validating incoming HMR requests. Prior to the patch, this method only checked the request URL and the sec-websocket-protocol header, but critically omitted a check on the Origin header. This allowed a malicious website visited by a developer to establish a WebSocket connection to their local Farm development server.

The handleUpgrade method, which is the entry point for handling these upgrade requests, would call the vulnerable isHMRRequest method. If it returned true (which it would for a malicious request with the correct URL and protocol header), handleUpgrade would proceed to establish the WebSocket connection, allowing the malicious site to steal source code and other sensitive information from the developer's machine.

The patch, committed in 83342ef06e0aea37270950fd8c930422c4df0679, rectifies this by adding an origin check within the isHMRRequest function. It generates a list of allowed origins based on the server configuration and validates the Origin header of incoming requests against this list. This ensures that only trusted origins can connect to the HMR WebSocket server.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.