PT-2026-24421 · Unknown · Feathersjs

Sofianeelhor · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-29793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Feathersjs versions 5.0.0 through 5.0.41

Description Feathersjs is a framework used for building web APIs and real-time applications. Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer does not validate the type of this argument. When using the MongoDB adapter, these objects are passed to the getObjectId() function and used directly in MongoDB queries as operators. Sending {$ne: null} as the id can match all documents within a collection.

Recommendations Update to version 5.0.42 or later.

Exploit

Fix

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-29793

GHSA-P9XR-7P9P-GPQX

Affected Products

Feathersjs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29793.json · Exploit
• https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29793 · Security Note
• https://osv.dev/vulnerability/GHSA-p9xr-7p9p-gpqx · Vendor Advisory
• https://github.com/feathersjs/feathers · Note
• https://twitter.com/0dayPublishing/status/2031466142498243030 · Twitter Post
• https://twitter.com/vulert_official/status/2031723984702877749 · Twitter Post
• https://twitter.com/CVEnew/status/2031504130498294032 · Twitter Post