CVE-2026-29793

Critical

Published: 10 March 2026

Published

10 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29793 is a critical-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Feathersjs Feathers. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the lack of type checking on the Socket.IO 'id' argument by requiring validation mechanisms to reject arbitrary JavaScript objects before they reach MongoDB queries.

SI-2 Flaw Remediation good match

prevent

Remediates the specific flaw in FeathersJS versions 5.0.0 to 5.0.41 by identifying, patching to 5.0.42 or later, and testing the update.

SI-9 Information Input Restrictions good match

prevent

Enforces restrictions on the 'id' input to limit it to valid identifiers like strings or ObjectIds, rejecting invalid inputs such as MongoDB query operators.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

Public-facing FeathersJS API vuln directly enables remote exploitation (T1190) with NoSQL operator injection into MongoDB, facilitating unauthorized DB data access (T1213.006), stored data manipulation (T1565.001), and data destruction (T1485).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The…

transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

Deeper analysisAI

CVE-2026-29793 is a high-severity vulnerability (CVSS 9.8) in the FeathersJS framework, which is used for building web APIs and real-time applications with TypeScript or JavaScript. Affecting versions from 5.0.0 up to but not including 5.0.42, the issue arises when Socket.IO clients send arbitrary JavaScript objects as the "id" argument to service methods such as get, patch, update, or remove. The transport layer lacks type checking on this argument, allowing these objects to pass through unimpeded.

In an attack scenario, unauthenticated remote attackers can exploit this over the network with low complexity and no user interaction required. When the application uses the MongoDB adapter, the malicious "id" objects bypass getObjectId() and are injected directly into MongoDB queries as operators. For example, sending {"$ne": null} as the id matches every document in the collection, enabling attackers to read, modify, or delete all data depending on the service method invoked, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H).

The FeathersJS security advisory at https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx details the fix in version 5.0.42, which introduces proper validation to prevent arbitrary objects from reaching the database query layer. Security practitioners should upgrade to 5.0.42 or later and review applications using Socket.IO with MongoDB adapters for exposure.