FazBrowse GitHub Viewer | Trending | | Home

Tools: [Download Repo ZIP] [Original HTTPS Page]

Overview · feathersjs/feathers · GitHub

Security

No security policy detected

This project has not set up a SECURITY.md file yet.

Query operator allow-list bypass in @feathersjs/adapter-commons allows $where code execution on @feathersjs/memory
GHSA-6qm5-r3g8-qgqh published Aug 14, 2026 by marshallswain

Critical
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
GHSA-28xv-ph75-77wh published Jun 4, 2026 by marshallswain

Low
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
GHSA-p9xr-7p9p-gpqx published Mar 10, 2026 by daffl

High
OAuth Callback Account Takeover
GHSA-wg9x-qfgw-pxhj published Mar 10, 2026 by daffl

Critical
Internal headers exposed via unencrypted session cookie
GHSA-9m9c-vpv5-9g85 published Feb 18, 2026 by daffl

Moderate
Origin validation bypass via prefix matching
GHSA-mp4x-c34x-wv3x published Feb 18, 2026 by daffl

High
Open redirect in OAuth callback enables account takeover
GHSA-ppf9-4ffw-hh4p published Feb 18, 2026 by daffl

High
Socket handler allows abusing implicit toString
GHSA-hhr9-rh25-hvf9 published Jul 19, 2023 by daffl

High

Learn more about advisories related to feathersjs/feathers in the GitHub Advisory Database

Back | FazBrowse Home | New Git URL