{"action":"Upgrade @feathersjs/transport-commons to 4.5.18 or later.","affected":[{"fixed":"4.5.18","introduced":"0"},{"fixed":"5.0.8","introduced":"5.0.0"}],"component":"@feathersjs/transport-commons","cve_ids":["CVE-2023-37899"],"ecosystem":"npm","epss":0.01188,"exploited":false,"fixed_versions":["4.5.18","5.0.8"],"ghsa_id":"GHSA-hhr9-rh25-hvf9","id":"tcs_01M5KFV9WYYMEY41Y50QZF8TCV","modified_at":"2023-11-08T04:13:03.762779Z","published_at":"2023-07-20T14:54:30Z","references":["https://osv.dev/vulnerability/GHSA-hhr9-rh25-hvf9","https://github.com/feathersjs/feathers/security/advisories/GHSA-hhr9-rh25-hvf9","https://nvd.nist.gov/vuln/detail/CVE-2023-37899","https://github.com/feathersjs/feathers/pull/3241","https://github.com/feathersjs/feathers/pull/3242","https://github.com/feathersjs/feathers/commit/0b9a6b19b12ad05934e4c8bd9917448ed39d1ed8","https://github.com/feathersjs/feathers/commit/c397ab3a0cd184044ae4f73540549b30a396821c","https://github.com/feathersjs/feathers","https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19","https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-hhr9-rh25-hvf9#npm/@feathersjs/transport-commons","url":"https://osv.dev/vulnerability/GHSA-hhr9-rh25-hvf9"}],"summary":"Feathers socket handler allows abusing implicit toString"}