What’s Vulnerable › Products

feathersjs feathers vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your feathersjs feathers version is affected

Latest feathersjs feathers vulnerabilities

• CVE-2026-54335 — Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ (CVSS 3.7)
• CVE-2026-29793 — NoSQL Injection via WebSocket id Parameter in MongoDB Adapter (CVSS 9.8)
• CVE-2026-29792 — Feathersjs has an OAuth Callback Account Takeover (CVSS 9.8)
• CVE-2026-27193 — Feathers exposes internal headers via unencrypted session cookie (CVSS 5.3)
• CVE-2026-27192 — Feathers has an origin validation bypass via prefix matching (CVSS 8.1)
• CVE-2026-27191 — Feathers: Open Redirect in OAuth callback enables account takeover (CVSS 6.1)
• CVE-2023-37899 — feathersjs socket handler allows abusing implicit toString (CVSS 7.5)