Feathersjs vulnerabilities
We track 6 vulnerabilities in Feathersjs products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on March 10, 2026.
Latest Feathersjs vulnerabilities
- 9.8 Critical severity
mongodb: Improper Neutralization of Special Elements in Data Query Logic
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove)
- 9.8 Critical severity
feathers: Improper Authentication
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the
- 8.1 High severity
feathers: Origin Validation Error
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shar
- 7.5 High severity
feathers: Improper Check for Unusual or Exceptional Conditions
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to
- 9.8 Critical severity
Feathers-Sequalize: Improper Neutralization of Special Elements used in an SQL Command
Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.
- 9.8 Critical severity
Feathers-Sequalize: Improperly Controlled Modification of Object Prototype Attributes
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.