Skip to content
Feathersjs vulnerabilities
Newest
-
feathersjs feathers
Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
CVE-2026-54335
Fix available
3.7 Low
-
@feathersjs mongodb, feathersjs feathers +1 more
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
CVE-2026-29793
Fix available
9.3 Critical
-
feathersjs feathers, @feathersjs authentication-oauth +1 more
Feathersjs has an OAuth Callback Account Takeover
CVE-2026-29792
Fix available
9.3 Critical
-
feathersjs feathers
Feathers exposes internal headers via unencrypted session cookie
CVE-2026-27193
Fix available
8.2 High
-
feathersjs feathers
Feathers has an origin validation bypass via prefix matching
CVE-2026-27192
Fix available
7.6 High
-
feathersjs feathers
Feathers: Open Redirect in OAuth callback enables account takeover
CVE-2026-27191
Fix available
7.4 High
-
feathersjs feathers
feathersjs socket handler allows abusing implicit toString
CVE-2023-37899
Fix available
7.5 High
-
feather js feathers-sequalize, feathersjs feathers-sequelize +1 more
Feathers - Query “__proto__” is converted to real prototype
CVE-2022-29823
Fix available
10.0 Critical
-
feather js feathers-sequalize, feathersjs feathers-sequelize +1 more
Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection
CVE-2022-29822
Fix available
10.0 Critical
-
feathersjs feathers-sequelize, feather js feathers-sequalize +1 more
Feathers - SQL injection via attribute aliases
CVE-2022-2422
Fix available
10.0 Critical