sync-rpc: Missing authentication leads to remote code execution

Summary

sync-rpc is an npm library for Node.js that runs asynchronous commands synchronously in a separate process. In versions before 1.3.7, the worker process accepts connections without proper authentication, so an attacker who can guess the port and reach it (not blocked by a firewall) can load and execute arbitrary JavaScript files stored on the server. The CNA rates this CVSS 4.0 8.7 (High); VulDB rates it 7.3.

Affected

• sync-rpc (npm) versions before 1.3.7 (CNA record: < 1.3.7; VulDB: up to 1.3.6)

Fixed in

• sync-rpc 1.3.7 and later

Workaround

• Use firewall rules to block access to the sync-rpc port, allowing only trusted hosts (third-party recommendation; the vendor advisory states that a restrictive firewall prevents remote exploitation)

Exploitation

• No evidence of exploitation in the wild on record.
• Not listed in CISA KEV.
• A public proof of concept has been reported but is unverified.

Our recommendation

• Check whether sync-rpc is used in your Node.js applications, for example with npm ls sync-rpc.
• Update sync-rpc to 1.3.7 or later.
• Until patched, ensure the port is not reachable from untrusted networks.
• Monitor for unexpected connections to the sync-rpc port.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-65843 www.cve.org
• GitHub Security Advisory GHSA-2x86-cf3f-86gw github.com
• Fix commit ffccfe5 github.com
• VulDB 435950 vuldb.com
• npm package sync-rpc www.npmjs.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:24.