Vulnerability in @Feathersjs MongoDB
CVE-2026-29793
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (44.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001
Affected products
- @Feathersjs MongoDB — versions >= 5.0.0, < 5.0.42
- Feathersjs Feathers
Weakness classification (CWE)
References
- github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-29793?
- CVE-2026-29793 is a critical-severity vulnerability in @Feathersjs MongoDB, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 9.8/10. Published 2026-03-10.
- How severe is CVE-2026-29793?
- Critical severity. CVSS v3 base score is 9.8 out of 10.