CVE-2026-29793General(feathersjs / feathers)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch feathersjs feathers systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

feathersjs CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx

Weakness type (CWE)

CWE-943

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

feathers

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-03-10); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

feathersjs

Products

feathers

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

General

133.3%

PoC

133.3%

Patch

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-10	2	General1PoC1
2026-03-11	1	Patch1

Full discourse3 posts

Vulert@vulert_official212d
Patch
🚨 CVE-2026-29793: NoSQL injection risk in @feathersjs/mongodb adapter. Update to the patched version + add strong input validation to prevent query manipulation/data access. 🔍 https://vulert.com/vuln-db/CVE-2026-29793 #CyberSecurity #AppSec #Vulert https://t.co/NWvSV1ibSH
Post summary
The tweet alerts users to a NoSQL injection vulnerability in the FeathersJS MongoDB adapter and advises updating to the patched version and strengthening input validation.
0001033
124 followersView on X
CVE@CVEnew212d
General
CVE-2026-29793 Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, http://Socket.IO clients can send arb… https://www.cve.org/CVERecord?id=CVE-2026-29793
Post summary
The excerpt lists CVE‑2026‑29793 as affecting Feathersjs (Socket.IO clients 5.0.0–5.0.41) but provides no actionable details, PoC, exploit, patch, or verification of its severity.
00000156
56.7K followersView on X
0day Signal@0dayPublishing212d
PoC
🚨 CVE-2026-29793: NoSQL Injection via WebSocket id... WebSocket clients can inject MongoDB operators via untypechecked `id` params—send `{$ne: null}` to dump entire collecti... https://zerodaysignal.com/vulnerability/CVE-2026-29793 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post highlights a NoSQL injection (CVE-2026-29793) by showing how a malicious `id` parameter can trigger a data dump, acting as a proof‑of‑concept demonstration.
0000047
142 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	feathersjs	feathers	-	node.js	-

Explore more

Back to dashboard feathersjs CVEs feathers vulnerabilities