CVE-2026-29793

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29793", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T16:26:02.900Z", "datePublished": "2026-03-10T20:08:52.109Z", "dateUpdated": "2026-03-11T14:09:19.913Z"}, "containers": {"cna": {"title": "NoSQL Injection via WebSocket id Parameter in MongoDB Adapter", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx"}], "affected": [{"vendor": "@feathersjs", "product": "mongodb", "versions": [{"version": ">= 5.0.0, < 5.0.42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:08:52.109Z"}, "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42."}], "source": {"advisory": "GHSA-p9xr-7p9p-gpqx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:09:12.628285Z", "id": "CVE-2026-29793", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:09:19.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "NoSQL Injection via WebSocket id Parameter in MongoDB Adapter", "source": {"advisory": "GHSA-p9xr-7p9p-gpqx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "@feathersjs", "product": "mongodb", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}], "references": [{"url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx", "name": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T20:08:52.109Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T14:09:12.628285Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T14:09:16.546Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-29793", "state": "PUBLISHED", "dateUpdated": "2026-03-10T20:08:52.109Z", "dateReserved": "2026-03-04T16:26:02.900Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T20:08:52.109Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mongodb", "vendor": "@feathersjs", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.0.42"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:feathersjs:feathers:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "485A252B-0C51-4136-A310-520BBD332346", "versionEndExcluding": "5.0.42", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42."}, {"lang": "es", "value": "Feathersjs es un framework para crear APIs web y aplicaciones en tiempo real con TypeScript o JavaScript. Desde la versi\u00f3n 5.0.0 hasta antes de la 5.0.42, los clientes de Socket.IO pueden enviar objetos JavaScript arbitrarios como argumento id a cualquier m\u00e9todo de servicio (get, patch, update, remove). La capa de transporte no realiza ninguna comprobaci\u00f3n de tipo en este argumento. Cuando el servicio utiliza el adaptador de MongoDB, estos objetos pasan por getObjectId() y llegan directamente a la consulta de MongoDB como operadores. Enviar {$ne: null} como id coincide con cada documento de la colecci\u00f3n. Esta vulnerabilidad se corrige en la versi\u00f3n 5.0.42."}], "id": "CVE-2026-29793", "lastModified": "2026-06-17T10:29:53.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29793", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:09:12.628285Z", "version": "2.0.3"}}]}, "published": "2026-03-10T20:16:39.437", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "mongodb", "source": "cna", "vendor": "@feathersjs"}, "product": "mongodb", "vendor": "feathersjs"}], "analysis": {"en": {"generated_at": "2026-04-16T03:26:06.301053+00:00", "value": {"mitigation_remediation": ["Upgrade FeathersJS to version 5.0.42 or later, which includes the fix that validates the id argument type before passing it to MongoDB.", "Implement server\u2011side validation to ensure the id parameter is a string or a valid ObjectId; reject any object types to prevent injection.", "Restrict access to the Socket.IO service to trusted clients or enforce authentication so that only authorized users can use the id parameter."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated data disclosure via NoSQL injection"}, "threat_synthesis": {"affected_systems": "This issue affects applications that use FeathersJS version 5.0.0 through 5.0.41 with the MongoDB adapter in a Node.js environment. The specific package is @feathersjs:mongodb. The attack can occur in any deployment that accepts Socket.IO connections to the Feathers services, including those built with TypeScript or JavaScript. Affected products include any FeathersJS-based API or real-time application relying on the MongoDB adapter during that release window.", "description_and_impact": "The vulnerability arises when Socket.IO clients send arbitrary JavaScript objects as the id argument to any service method. Because the transport layer does not perform type checking, these objects flow into the MongoDB adapter where getObjectId() inserts them directly into the query as operators. Consequently, an attacker can craft input such as {$ne: null} to match all documents, or other query operators, leading to unauthorized disclosure of all documents in the affected collection. The weakness is a NoSQL injection (CWE-943) that can be leveraged without authentication to read data the attacker is not entitled to access, potentially exposing sensitive information.", "risk_and_exploitability": "The CVSS score of 9.3 reflects a severe impact. The EPSS score is below 1\u202f%, indicating the current probability of exploitation is very low, and the vulnerability is not listed in CISA\u2019s KEV catalog. Attackers can exploit this remotely by connecting to the service via WebSocket and sending a crafted id object, typically with no authentication required. Once the NoSQL injection is successful, the attacker can read entire collections or retrieve sensitive data, potentially causing a major breach of confidentiality and business impact. The only requirement is remote access to the WebSocket endpoint; no special privileges are needed."}}}}, "created": "2026-03-11T11:43:01.698057+00:00", "updated": "2026-04-16T03:30:06.068266+00:00", "vendors": ["feathersjs", "feathersjs$PRODUCT$mongodb"]}