CVE-2026-54335Disclosure

LOWCVSS 3.7 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-17); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-17	2	Disclosure1General1
2026-07-18	1	Disclosure1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-54335 Prototype Pollution in Feathersjs @feathersjs/commons Utility Versions 5... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54335 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
CVE‑2026‑54335 has been disclosed as a prototype‑pollution flaw in Feathersjs, with technical details and notification links available via Vulmon. No exploitation evidence or patch information is included.
0000092
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-54335 Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility e… https://www.cve.org/CVERecord?id=CVE-2026-54335 ----- Traducción: CVE-2026-54335 Fea… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑54335 affecting Feathersjs versions 5.0.44 and earlier, noting a flaw in the _.merge function, but offers no further technical, exploit, or remediation details.
0000035
92 followersView on X
CVE@CVEnew92d
General
CVE-2026-54335 Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility e… https://www.cve.org/CVERecord?id=CVE-2026-54335
Post summary
The entry references CVE‑2026‑54335 in Feathersjs but provides no substantial detail, links, or mitigation information.
00000750
57.8K followersView on X

Explore more

Back to dashboard