feathersjs

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

feathersjs records in CISA KEV

No feathersjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Feathers 6 records HIGH Feathers-sequelize 3 records MEDIUM

Records

6 records in Feathers · all components

TI-2023-19332 CVE-2023-37899 · GHSA-hhr9-rh25-hvf9

feathersjs socket handler allows abusing implicit toString

HIGH 72

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01188 Published 2023-07-19 Fixed in 4.5.18, 5.0.8 CWE-754

TI-2026-23379 CVE-2026-29793 · GHSA-p9xr-7p9p-gpqx

NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

MEDIUM 49

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00508 Published 2026-03-10 Fixed in 5.0.42 CWE-943

TI-2026-23378 CVE-2026-29792 · GHSA-wg9x-qfgw-pxhj

Feathersjs has an OAuth Callback Account Takeover

MEDIUM 49

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00573 Published 2026-03-10 Fixed in 5.0.42 CWE-287

TI-2026-21630 CVE-2026-27193 · GHSA-9m9c-vpv5-9g85

Feathers exposes internal headers via unencrypted session cookie

LOW 36

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00398 Published 2026-02-21 Fixed in 5.0.40 CWE-200

TI-2026-21629 CVE-2026-27192 · GHSA-mp4x-c34x-wv3x

Feathers has an origin validation bypass via prefix matching

LOW 35

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.0027 Published 2026-02-21 Fixed in 5.0.40 CWE-346

TI-2026-21628 CVE-2026-27191 · GHSA-ppf9-4ffw-hh4p

Feathers: Open Redirect in OAuth callback enables account takeover

LOW 34

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00293 Published 2026-02-21 Fixed in 5.0.40 CWE-601

Open these records in search →