p PatchFirst

PatchFirst · Latest vulnerabilities

@feathersjs/mongodb vulnerabilities

Vulnerabilities published for @feathersjs/mongodb in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-29793

    Critical · CVSS 9.3EPSS 0.48%Fix available

    NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

    Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

    @feathersjs/mongodbNode.js
    • Update to 5.0.42
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →