Feathers exposes internal headers via unencrypted session cookie

Description

All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.

Recommendation

Update the @feathersjs/authentication-oauth package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.0.39
• Patched version(s): 5.0.40

References

• GHSA-9m9c-vpv5-9g85
• CVE-2026-27193
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6