npm/@feathersjs/commons CVE-2026-54335: low 3.7, EPSS 0.39%
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
Action: Upgrade @feathersjs/commons to 5.0.45 or later.
npm i @feathersjs/commons@5.0.45Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.45 | - |
Fixed versions
| 5.0.45 |
Sources
- osv: GHSA-28xv-ph75-77wh
- https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh
- https://github.com/feathersjs/feathers/pull/3690
- https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc
- https://github.com/feathersjs/feathers
- https://github.com/feathersjs/feathers/releases/tag/v5.0.45
CVE-2026-54335 · published · modified · JSON