CVE-2025-56647: Farm Core WebSocket Origin Vulnerability

CVE-2025-56647 Overview

A Missing Origin Validation vulnerability has been identified in the npm @farmfe/core package before version 1.7.6. The development server's hot module reloading (HMR) functionality fails to validate the origin when establishing WebSocket connections with clients. This security flaw enables attackers to surveil developers running Farm who visit attacker-controlled webpages and subsequently steal source code that is leaked by the WebSocket server.

Critical Impact
Attackers can exploit this vulnerability to steal source code from developers using the Farm development server by leveraging malicious webpages to establish unauthorized WebSocket connections.

Affected Products

npm @farmfe/core versions prior to 1.7.6

Discovery Timeline

2026-02-12 - CVE-2025-56647 published to NVD
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-56647

Vulnerability Analysis

This vulnerability falls under CWE-1385 (Missing Origin Validation in WebSockets), a critical security control gap in web application development servers. The Farm development server implements hot module reloading functionality through WebSocket connections to provide real-time code updates during development. However, the server fails to implement proper origin validation checks when accepting incoming WebSocket connection requests.

When a developer runs the Farm development server locally, it exposes a WebSocket endpoint that serves source code files and module information to connected clients. Without origin validation, any webpage can establish a connection to this WebSocket endpoint, bypassing the browser's same-origin policy protections that typically protect against cross-origin attacks. This allows a malicious website to connect to the developer's local development server and exfiltrate source code, configuration files, and other sensitive development artifacts.

Root Cause

The root cause of this vulnerability is the absence of origin header validation in the WebSocket handshake process within the Farm development server. WebSocket connections bypass the browser's same-origin policy by design, relying instead on server-side origin validation to prevent unauthorized cross-origin connections. The Farm development server omitted this critical security check, allowing any webpage regardless of origin to establish a WebSocket connection and receive source code updates intended only for the legitimate development environment.

Attack Vector

The attack vector requires user interaction where a developer using the vulnerable Farm development server visits a malicious webpage. The attack proceeds as follows:

The attacker hosts a malicious webpage containing JavaScript that attempts to connect to common local development server ports
A developer running Farm's development server locally visits the attacker's webpage
The malicious JavaScript establishes a WebSocket connection to the developer's local Farm server
Due to missing origin validation, the connection is accepted
The attacker's script can then request and receive source code files, module information, and other development data through the WebSocket connection

The vulnerability is classified as network-accessible, requiring no authentication but does require user interaction (visiting a malicious site). This enables information disclosure with high confidentiality impact as attackers gain access to potentially sensitive source code.

Detection Methods for CVE-2025-56647

Indicators of Compromise

Unexpected WebSocket connections to local development server ports from unknown origins
Browser developer tools showing WebSocket connections initiated from external domains to localhost
Network traffic analysis revealing cross-origin WebSocket handshakes to development server ports
Unusual outbound data transfers from development machine during web browsing sessions

Detection Strategies

Monitor network connections to local development server ports for connections originating from non-localhost sources
Implement browser extensions or security tools that alert on cross-origin WebSocket connections to localhost
Review browser console and network logs for unauthorized WebSocket connections during development sessions
Configure host-based intrusion detection to flag unexpected connections to development server ports

Monitoring Recommendations

Enable verbose logging on development servers to track connection origins
Use network monitoring tools to inspect WebSocket traffic during development sessions
Implement Content Security Policy headers on development environments where possible
Consider running development servers in isolated network environments when working with sensitive code

How to Mitigate CVE-2025-56647

Immediate Actions Required

Upgrade @farmfe/core to version 1.7.6 or later immediately
Audit any source code that may have been exposed if the vulnerable version was used while visiting untrusted websites
Consider rotating any credentials, API keys, or secrets that may have been present in exposed source code
Review network logs for any suspicious WebSocket connections to development server ports

Patch Information

The vulnerability has been addressed in @farmfe/core version 1.7.6. The fix implements proper origin validation for WebSocket connections to the development server. Technical details of the fix can be reviewed in the GitHub commit. Additional context is available in the GitHub issue discussion and a proof-of-concept demonstration illustrates the exploitation technique.

Workarounds

Avoid visiting untrusted websites while running the Farm development server
Configure firewall rules to block incoming connections to development server ports from non-localhost sources
Run development servers only within isolated network environments or virtual machines
Use browser profiles with strict security settings dedicated to development work
Consider using a VPN or network segmentation to isolate development traffic

bash

# Configuration example
# Upgrade @farmfe/core to patched version
npm update @farmfe/core@1.7.6

# Or install the specific patched version
npm install @farmfe/core@^1.7.6

# Verify installed version
npm list @farmfe/core