CVE-2026-29793

The Feathers.js transport layer does not verify the type of the id argument passed by Socket.IO clients to service methods (get, patch, update, remove). When a service uses the MongoDB adapter, the passed object is sent without validation to the getObjectId() function, and then directly to the MongoDB query as an operator. For example, sending the object {"$ne": null} as id matches every document in the collection, because MongoDB interprets it as a valid comparison operator.

An unauthenticated attacker can read, modify, or delete all documents in the affected MongoDB collection, resulting in complete loss of confidentiality, integrity, and availability of stored data.

Feathers.js must be updated to version 5.0.42 or later, where the vulnerability has been fixed. Detailed information is available in the vendor references (GHSA-p9xr-7p9p-gpqx).

Feathersjs Feathers in versions 5.0.0 to 5.0.41 (inclusive), using the MongoDB adapter.