Skip to content
OpenAdvisories

Vendor

feathersjs

7 known vulnerabilities.

Products

feathers 6 authentication-oauth 1 mongodb 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-29793

    NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

    Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove…

    feathersjs mongodb @feathersjs/mongodb npm
  • Critical 9.3
    CVE-2026-29792

    Feathersjs has an OAuth Callback Account Takeover

    Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in th…

    feathersjs feathers authentication-oauth @feathersjs/authentication-oauth npm