Read the docs

feathersjs

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

feathersjs records in CISA KEV

No feathersjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Feathers 6 records HIGH Feathers-sequelize 3 records MEDIUM

Records

10 records

TI-2023-19332 CVE-2023-37899 · GHSA-hhr9-rh25-hvf9

feathersjs socket handler allows abusing implicit toString

Priority HIGH 72

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01188 Published 2023-07-19 Fixed in 4.5.18, 5.0.8 CWE-754
TI-2026-23378 CVE-2026-29792 · GHSA-wg9x-qfgw-pxhj

Feathersjs has an OAuth Callback Account Takeover

Priority MEDIUM 49

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00573 Published 2026-03-10 Fixed in 5.0.42 CWE-287
TI-2022-12183 CVE-2022-29823 · GHSA-p5m3-27vh-52j4

Feathers - Query “__proto__” is converted to real prototype

Priority MEDIUM 47

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01834 Published 2022-10-25 Fixed in 6.3.4, 6.3.3 CWE-1321
TI-2022-02237 CVE-2022-2422 · GHSA-qpv8-4pjq-qqh7

Feathers - SQL injection via attribute aliases

Priority MEDIUM 45

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00931 Published 2022-10-25 Fixed in 6.3.4 CWE-89
Open these records in search →