Read the docs
TI-2026-23379 Aliases CVE-2026-29793GHSA-p9xr-7p9p-gpqx

NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Priority MEDIUM 49CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00508 43rd percentileScored 2026-11-07
Fix Fixed mongodb (@feathersjs): 5.0.42@feathersjs/mongodb (npm): 5.0.42

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
feathersjsmongodb5.0.0 to before 5.0.425.0.42Patch availableCNA
—@feathersjs/mongodb (npm)5.0.0 to before 5.0.425.0.42Patch availableGHSA-p9xr-7p9p-gpqx
  • mongodb Vendorfeathersjs Affected 5.0.0 to before 5.0.42 Fixed in 5.0.42 Patch available CNA
  • @feathersjs/mongodb (npm) Vendor— Affected 5.0.0 to before 5.0.42 Fixed in 5.0.42 Patch available GHSA-p9xr-7p9p-gpqx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:*5.0.0 to before 5.0.42Vulnerablefeathersjs
  • cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:* Versions 5.0.0 to before 5.0.42 Vulnerable ·feathersjs

Remediation

  • Fix · CNA mongodb (@feathersjs) Fixed in 5.0.42
  • Fix · GHSA-p9xr-7p9p-gpqx @feathersjs/mongodb (npm) Fixed in 5.0.42 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29793
  2. 2026-10-03 Alias added: GHSA-p9xr-7p9p-gpqx

References

Advisory 2

Other 1

  • TI-2023-19332 feathersjs socket handler allows abusing implicit toString CVSS 3.1HIGH 7.5
  • TI-2026-23378 Feathersjs has an OAuth Callback Account Takeover CVSS 4.0CRITICAL 9.3
  • TI-2026-21630 Feathers exposes internal headers via unencrypted session cookie CVSS 4.0HIGH 8.2
  • TI-2026-21629 Feathers has an origin validation bypass via prefix matching CVSS 4.0HIGH 7.6
  • TI-2026-21628 Feathers: Open Redirect in OAuth callback enables account takeover CVSS 4.0HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences