CVE-2026-29793 json
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
published 2026-03-10 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-10827 , GHSA-p9xr-7p9p-gpqx
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.
Patch / fix
- npm @feathersjs/mongodb 5.0.42
- featherjs mongodb 5.0.42
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @feathersjs/mongodb | >=5.0.0, <5.0.42 |
5.0.42 |
Affected products
- @feathersjs mongodb
Classification
- Weakness
-
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
References
-
github.com
/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-29793
advisory
-
github.com
/feathersjs/feathers
package
Sources
- CVE List CVE-2026-29793
- GitHub Advisory GHSA-p9xr-7p9p-gpqx
- NVD CVE-2026-29793
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.