Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Description

Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators.

Recommendation

Update the @feathersjs/mongodb package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.0.0, <= 5.0.41
• Patched version(s): 5.0.42

References

• GHSA-p9xr-7p9p-gpqx
• CVE-2026-29793
• CWE-943
• CAPEC-310
• OWASP 2021-A6

Related Issues

• LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access - CVE-2026-48121
• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
• Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940
• Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@feathersjs/mongodb