CVE-2026-29793

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-29793 is a high-severity vulnerability (CVSS 9.8) in the FeathersJS framework, which is used for building web APIs and real-time applications with TypeScript or JavaScript. Affecting versions from 5.0.0 up to but not including 5.0.42, the issue arises when Socket.IO clients send arbitrary JavaScript objects as the "id" argument to service methods such as get, patch, update, or remove. The transport layer lacks type checking on this argument, allowing these objects to pass through unimpeded.

In an attack scenario, unauthenticated remote attackers can exploit this over the network with low complexity and no user interaction required. When the application uses the MongoDB adapter, the malicious "id" objects bypass getObjectId() and are injected directly into MongoDB queries as operators. For example, sending {"$ne": null} as the id matches every document in the collection, enabling attackers to read, modify, or delete all data depending on the service method invoked, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H).

The FeathersJS security advisory at https://github.com/feathersjs/feathers/security/advisories/GHSA-p9xr-7p9p-gpqx details the fix in version 5.0.42, which introduces proper validation to prevent arbitrary objects from reaching the database query layer. Security practitioners should upgrade to 5.0.42 or later and review applications using Socket.IO with MongoDB adapters for exposure.