Feathersjs Feathers vulnerabilities

CVE-2026-29792 [CRITICAL] CWE-287 CVE-2026-29792: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reach

CVE-2026-29793 [CRITICAL] CWE-943 CVE-2026-29793: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses t

CVE-2026-27192 [HIGH] CWE-346 CVE-2026-27192: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Refer

CVE-2023-37899 [HIGH] CWE-754 CVE-2023-37899: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' }

CVE-2026-27193 [MEDIUM] CWE-200 CVE-2026-27193: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session,

CVE-2026-27191 [MEDIUM] CWE-601 CVE-2026-27191: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaSc Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the vic