Feathersjs Feathers vulnerabilities

• feathersjs feathers Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ CVE-2026-54335 Fix available 3.7 LowJuly 14, 2026
• @feathersjs mongodb, feathersjs feathers +1 more NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVE-2026-29793 Fix available 9.3 CriticalMarch 10, 2026
• feathersjs feathers, @feathersjs authentication-oauth +1 more Feathersjs has an OAuth Callback Account Takeover CVE-2026-29792 Fix available 9.3 CriticalMarch 10, 2026
• feathersjs feathers Feathers exposes internal headers via unencrypted session cookie CVE-2026-27193 Fix available 8.2 HighFebruary 19, 2026
• feathersjs feathers Feathers has an origin validation bypass via prefix matching CVE-2026-27192 Fix available 7.6 HighFebruary 19, 2026
• feathersjs feathers Feathers: Open Redirect in OAuth callback enables account takeover CVE-2026-27191 Fix available 7.4 HighFebruary 19, 2026
• feathersjs feathers feathersjs socket handler allows abusing implicit toString CVE-2023-37899 Fix available 7.5 HighJuly 19, 2023
• feather js feathers-sequalize, feathersjs feathers-sequelize +1 more Feathers - Query “__proto__” is converted to real prototype CVE-2022-29823 Fix available 10.0 CriticalOctober 25, 2022
• feather js feathers-sequalize, feathersjs feathers-sequelize +1 more Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection CVE-2022-29822 Fix available 10.0 CriticalOctober 25, 2022
• feathersjs feathers-sequelize, feather js feathers-sequalize +1 more Feathers - SQL injection via attribute aliases CVE-2022-2422 Fix available 10.0 CriticalOctober 25, 2022