CVE-2026-54335

Received Received - Intake

Prototype Pollution in FeathersJS Framework

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-54335

Affected Vendors & Products

Vendor	Product	Version / Range
feathersjs	feathers	to 5.0.45 (exc)
feathersjs	feathers	5.0.45

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability affects FeathersJS versions 5.0.44 and earlier. It involves a prototype pollution issue in the _.merge utility from @feathersjs/commons. When JSON.parse produces an object containing special keys like __proto__, constructor, or prototype, these keys can be merged into other objects, modifying Object.prototype. This leads to all plain objects inheriting attacker-controlled properties for the lifetime of the Node process.

Detection Guidance

This vulnerability can be detected by checking the version of @feathersjs/commons in your project. Run 'npm list @feathersjs/commons' or check your package.json file. If the version is 5.0.44 or earlier, the system is vulnerable.

Impact Analysis

An attacker could exploit this to alter the behavior of your application by injecting malicious properties into Object.prototype. This might cause unexpected behavior, data corruption, or security bypasses in your application or any dependent libraries. The impact depends on how the application uses merged objects.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling prototype pollution, which may lead to unauthorized data access or manipulation. If exploited, it could compromise data integrity or confidentiality, violating principles of these regulations.

Mitigation Strategies

Upgrade @feathersjs/commons to version 5.0.45 or later immediately. Run 'npm update @feathersjs/commons' or manually update the dependency in package.json and reinstall dependencies.

Hi! I’m here to help you understand CVE-2026-54335. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70