Description
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators.
Recommendation
Update the @feathersjs/mongodb package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.0, <= 5.0.41
- Patched version(s): 5.0.42
References
Could your website be exposed too?
SmartScanner can check your website for Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access - CVE-2026-48121
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
- Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940
- Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941
You might also like:
See something that needs correcting? Let us knowUpdated March 10, 2026