npm/@feathersjs/mongodb CVE-2026-29793: critical 9.8, EPSS 0.48%
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Action: Upgrade @feathersjs/mongodb to 5.0.42 or later.
npm i @feathersjs/mongodb@5.0.42Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.0.42 | - |
Fixed versions
| 5.0.42 |
Sources
- osv: GHSA-p9xr-7p9p-gpqx
- nvd: CVE-2026-29793
- https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx
- https://github.com/feathersjs/feathers
CVE-2026-29793 · published · modified · JSON