CVE-2026-54335 Details
Description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.
A prototype pollution vulnerability has been identified in the Feathersjs framework, specifically in versions of the '@feathersjs/commons' package through 5.0.44. The issue arises in the '_.merge(target, source)' utility, which recursively merges properties from the source object into the target object. When the source object is created using JSON.parse and includes keys like '__proto__', 'constructor', or 'prototype', these keys are treated as own-enumerable properties. This allows an attacker to manipulate the Object.prototype by injecting properties, which then affects all plain objects for the duration of the Node process.
Users can upgrade to '@feathersjs/commons' version 5.0.45, which addresses the vulnerability by skipping prototype-polluting keys during the merge process. For applications that cannot immediately upgrade, avoid using '_.merge' with untrusted, JSON-parsed input.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc | [email protected] | Source CodeVendor |
| https://github.com/feathersjs/feathers/pull/3690 | [email protected] | Issue TrackingVendor |
| https://github.com/feathersjs/feathers/releases/tag/v5.0.45 | [email protected] | Release NotesVendor |
| https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Feathersjs | <= 5.0.44 (semver) |
CPE
Remediation
| |
| Feathersjs Commons | <= 5.0.44 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |