Vulnerabilities

TI-2026-39229 CVE-2026-54335 · GHSA-28xv-ph75-77wh

Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed proto

LOW 18

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00389 Published 2026-07-17 Fixed in 5.0.45 CWE-1321

TI-2026-23379 CVE-2026-29793 · GHSA-p9xr-7p9p-gpqx

NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

MEDIUM 49

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00508 Published 2026-03-10 Fixed in 5.0.42 CWE-943

TI-2026-23378 CVE-2026-29792 · GHSA-wg9x-qfgw-pxhj

Feathersjs has an OAuth Callback Account Takeover

MEDIUM 49

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00573 Published 2026-03-10 Fixed in 5.0.42 CWE-287

TI-2026-21630 CVE-2026-27193 · GHSA-9m9c-vpv5-9g85

Feathers exposes internal headers via unencrypted session cookie

LOW 36

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00398 Published 2026-02-21 Fixed in 5.0.40 CWE-200

TI-2026-21629 CVE-2026-27192 · GHSA-mp4x-c34x-wv3x

Feathers has an origin validation bypass via prefix matching

LOW 35

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.0027 Published 2026-02-21 Fixed in 5.0.40 CWE-346

TI-2026-21628 CVE-2026-27191 · GHSA-ppf9-4ffw-hh4p

Feathers: Open Redirect in OAuth callback enables account takeover

LOW 34

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00293 Published 2026-02-21 Fixed in 5.0.40 CWE-601

TI-2023-19332 CVE-2023-37899 · GHSA-hhr9-rh25-hvf9

feathersjs socket handler allows abusing implicit toString

HIGH 72

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01188 Published 2023-07-19 Fixed in 4.5.18, 5.0.8 CWE-754

TI-2022-12183 CVE-2022-29823 · GHSA-p5m3-27vh-52j4

Feathers - Query “proto” is converted to real prototype

MEDIUM 47

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01834 Published 2022-10-25 Fixed in 6.3.4, 6.3.3 CWE-1321

TI-2022-12182 CVE-2022-29822 · GHSA-5hq7-j5wq-p227

Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection

MEDIUM 45

Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00931 Published 2022-10-25 Fixed in 6.3.4 CWE-89

TI-2022-02237 CVE-2022-2422 · GHSA-qpv8-4pjq-qqh7

Feathers - SQL injection via attribute aliases

MEDIUM 45

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00931 Published 2022-10-25 Fixed in 6.3.4 CWE-89

Vulnerabilities

Filters