CVE-2026-29793: Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection.
Published Mar 10, 2026
Affected packages
@feathersjs/mongodb
- Ecosystem
- npm
- Affected
- >= 5.0.0, <= 5.0.41
- Fixed in
- 5.0.42
- Check
npm ls @feathersjs/mongodb
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection.
Credited to sofianeelhor.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology