Security Advisories
What we find in the FiveM platform, in txAdmin and across the network stack — documented in the open. We publish the root cause, impact and fix, but never a working exploit.
Advisories
3 published- HXA-2026-001CriticalOpen
Ungated native addon loading in the server JS runtime → native code execution inside FXServer
Server-side JavaScript resources run in an embedded Node.js that FiveM gates with a permission handler. Native addon loading is not covered by that gate at all — any JS resource can load a bundled .node file and thereby execute arbitrary native code inside the server process.
- HXA-2026-003HighOpen
Out-of-bounds write in the NetGameEventV2 handler via a client-controlled index
A client-supplied player index is used as an index into an undersized bitset before any validation. Any connected client can thereby trigger an out-of-bounds read and write at a chosen offset in the sync thread's memory.
- HXA-2026-002HighOpen
Attacker-controlled OAuth redirect_uri → admin account takeover via one click
txAdmin's login redirect takes the callback origin from the request without validation and binds the OAuth state to the requester's session rather than to the person who logs in. Without PKCE, a single clicked link is enough to take over an admin's session.