CVE-2026-29793: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29793 is a NoSQL injection vulnerability in the Feathersjs framework's MongoDB adapter, allowing unauthenticated Socket.IO clients to inject arbitrary MongoDB query operators via the id parameter of service methods. It affects @feathersjs/mongodb versions 5.0.0 through 5.0.41 and was disclosed on March 10, 2026, by researcher sofianeelhor. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feathersjs Advisory).

The root cause is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), a form of NoSQL injection (CAPEC-676). The Feathersjs Socket.IO transport layer performs no type checking on the id argument passed to service methods (get, patch, update, remove), allowing clients to supply arbitrary JavaScript objects instead of a string or ObjectId. When the MongoDB adapter processes these objects via getObjectId(), they are passed directly into the MongoDB query without sanitization, enabling injection of MongoDB operators such as {$ne: null}, which matches every document in the collection. No authentication, special privileges, or user interaction is required to exploit this vulnerability (GitHub Advisory, Feathersjs Advisory).

Successful exploitation allows an unauthenticated attacker to bypass authorization filters and perform unauthorized read, modify, or delete operations against all documents in the MongoDB collection. For example, sending {$ne: null} as the id parameter to a remove service method would delete every document in the collection, while using it with get or patch enables mass data exfiltration or manipulation. The impact spans full confidentiality, integrity, and availability loss for all MongoDB-backed data managed by the vulnerable Feathersjs application (Feathersjs Advisory, GitHub Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog (GitHub Advisory). The EPSS score is approximately 0.015–0.024%, placing it in the 7th percentile for exploitation likelihood within 30 days. However, the attack requires no authentication, no user interaction, and no special configuration beyond the use of the MongoDB adapter with Socket.IO transport, making it trivially exploitable if a public-facing application is identified.

1. Reconnaissance: Identify internet-facing applications built on Feathersjs (versions 5.0.0–5.0.41) using the MongoDB adapter. Look for Socket.IO endpoints in JavaScript bundles, API documentation, or network traffic analysis.
2. Establish Socket.IO connection: Connect to the target application's Socket.IO endpoint using a standard Socket.IO client library (e.g., socket.io-client in Node.js or browser).
3. Identify target service: Enumerate available Feathersjs service methods (e.g., get, patch, update, remove) by observing application behavior or reviewing client-side code.
4. Inject MongoDB operator as id: Send a service method call with a MongoDB operator object as the id argument instead of a valid document ID. For example, emit a Socket.IO event such as: socket.emit('serviceName::get', {$ne: null}, {}, callback) to match all documents.
5. Achieve mass data access or destruction: Depending on the targeted method — use get/find for data exfiltration, patch/update for mass data manipulation, or remove for mass deletion of all matched documents in the collection (Feathersjs Advisory, GitHub Advisory).

• Network: Unusual Socket.IO traffic containing JavaScript object literals (e.g., {"$ne": null}, {"$gt": ""}, {"$where": "..."}) in the id field of service method calls; high-volume Socket.IO requests to service endpoints from a single source IP.
• Logs: Application logs showing service method calls (get, patch, update, remove) with non-string, non-ObjectId id values; MongoDB query logs containing operators like $ne, $gt, $regex, or $where in document ID fields; unexpected bulk document reads, updates, or deletions in MongoDB audit logs.
• Database: Sudden mass deletion or modification of records across a collection; unexpected changes to all documents simultaneously; MongoDB slow query logs showing queries matching large numbers of documents via operator-based id filters.

Upgrade @feathersjs/mongodb to version 5.0.42 or later, which introduces type validation on the id argument to prevent injection of arbitrary objects (Feathersjs Advisory, GitHub Advisory). As an interim workaround if immediate patching is not possible, implement network-level controls to restrict Socket.IO access to trusted clients only, and add application-level hooks to validate and enforce strict typing (string or ObjectId) on the id parameter before it reaches the MongoDB adapter. Review application logs for suspicious service method calls containing MongoDB operator keys ($ne, $gt, $where, etc.) in the id field.

The vulnerability was reported by security researcher sofianeelhor and published by Feathersjs maintainer daffl via a GitHub Security Advisory on March 10, 2026 (Feathersjs Advisory). The issue was also noted on Bluesky and tracked by multiple vulnerability aggregators including VulDB, INCIBE-CERT, and Wiz. No significant broader media coverage or notable researcher commentary beyond the advisory has been identified.