CVE-2023-37899: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string…

PriorityP339high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.96%

57.2th percentile

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
feathersjs	feathers	< 4.5.18	4.5.18
feathersjs	feathers	—	—
feathersjs	feathers	>= 5.0.0 < 5.0.8	5.0.8
feathersjs	socketio	>= 0 < 4.5.18	4.5.18
feathersjs	socketio	>= 5.0.0 < 5.0.8	5.0.8
feathersjs	transport-commons	>= 0 < 4.5.18	4.5.18
feathersjs	transport-commons	>= 5.0.0 < 5.0.8	5.0.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.