CVE-2023-37899highCWE-754

CVE-2023-37899: falha de alta gravidade em feathersjs feathers

feathersjs socket handler allows abusing implicit toString

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar feathers+ Monitorar @feathersjs/socketio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.2%
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
feathersjs · feathers
CVEs relacionadas — feathersjs feathers

No mesmo produto, das mais perigosas para as menos.

CVE-2026-29792CRITICALFeathersjs has an OAuth Callback Account TakeoverEPSS 0.6%CVE-2026-27193HIGHFeathers exposes internal headers via unencrypted session cookieEPSS 0.4%CVE-2026-54335LOWFeathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__EPSS 0.4%CVE-2026-27191HIGHFeathers: Open Redirect in OAuth callback enables account takeoverEPSS 0.3%CVE-2026-27192HIGHFeathers has an origin validation bypass via prefix matchingEPSS 0.3%