CVE-2026-29793

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

CVSS

No CVSS.

References

Link	Resource
https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx

Configurations

No configuration.

History

11 Mar 2026, 13:52

Type	Values Removed	Values Added
Summary		(es) Feathersjs es un framework para crear APIs web y aplicaciones en tiempo real con TypeScript o JavaScript. Desde la versión 5.0.0 hasta antes de la 5.0.42, los clientes de Socket.IO pueden enviar objetos JavaScript arbitrarios como argumento id a cualquier método de servicio (get, patch, update, remove). La capa de transporte no realiza ninguna comprobación de tipo en este argumento. Cuando el servicio utiliza el adaptador de MongoDB, estos objetos pasan por getObjectId() y llegan directamente a la consulta de MongoDB como operadores. Enviar {$ne: null} como id coincide con cada documento de la colección. Esta vulnerabilidad se corrige en la versión 5.0.42.

10 Mar 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-10 20:16

Updated : 2026-03-11 13:52

NVD link : CVE-2026-29793

Mitre link : CVE-2026-29793

CVE.ORG link : CVE-2026-29793

JSON object : View

Products Affected

No product.

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-29793", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-10T20:16:39.437", "references": [{"url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42."}, {"lang": "es", "value": "Feathersjs es un framework para crear APIs web y aplicaciones en tiempo real con TypeScript o JavaScript. Desde la versi\u00f3n 5.0.0 hasta antes de la 5.0.42, los clientes de Socket.IO pueden enviar objetos JavaScript arbitrarios como argumento id a cualquier m\u00e9todo de servicio (get, patch, update, remove). La capa de transporte no realiza ninguna comprobaci\u00f3n de tipo en este argumento. Cuando el servicio utiliza el adaptador de MongoDB, estos objetos pasan por getObjectId() y llegan directamente a la consulta de MongoDB como operadores. Enviar {$ne: null} como id coincide con cada documento de la colecci\u00f3n. Esta vulnerabilidad se corrige en la versi\u00f3n 5.0.42."}], "lastModified": "2026-03-11T13:52:47.683", "sourceIdentifier": "security-advisories@github.com"}