9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29793

CVE-2026-29793: NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId() and land directly in the MongoDB query as operators. Sending {$ne: null} as the id matches every document in the collection. This vulnerability is fixed in 5.0.42.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29793

CVE-2026-29793:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/mongodb	npm	>= 5.0.0, <= 5.0.41	5.0.42

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @feathersjs/mongodb package, specifically within the MongoDbAdapter. The core issue is a NoSQL injection vulnerability stemming from improper validation of the id parameter in several service methods (get, patch, update, remove). The advisory states that Socket.IO clients can send arbitrary JavaScript objects as the id. The patch, found in commit 163e664f231a57041034c852b80525fc5c8cf68d, confirms this by adding a type check to ensure the id is a string, number, or a MongoDB ObjectId. Without this check, an attacker could pass a query operator object like {$ne: null} as the id. This malicious object would be directly incorporated into the MongoDB query, causing it to match all documents in the collection rather than the single document intended. This allows an attacker to read, modify, or delete all data accessible to the service. The identified functions are the public methods of the adapter that were susceptible to this injection.

Vulnerable functions

MongoDbAdapter.get

packages/mongodb/src/adapter.ts

The 'get' method takes an 'id' parameter that is used to construct a MongoDB query. Prior to the patch, this method did not validate the type of the 'id'. A malicious user could send a specially crafted object (e.g., `{$ne: null}`) as the 'id' through a Socket.IO client. This object would be interpreted as a query operator by MongoDB, allowing the attacker to retrieve all documents in the collection instead of a single one.

MongoDbAdapter.patch

packages/mongodb/src/adapter.ts

The 'patch' method takes an 'id' parameter that is used to construct a MongoDB query. Prior to the patch, this method did not validate the type of the 'id'. A malicious user could send a specially crafted object (e.g., `{$ne: null}`) as the 'id' through a Socket.IO client. This object would be interpreted as a query operator by MongoDB, allowing the attacker to patch all documents in the collection instead of a single one.

MongoDbAdapter.update

packages/mongodb/src/adapter.ts

The 'update' method takes an 'id' parameter that is used to construct a MongoDB query. Prior to the patch, this method did not validate the type of the 'id'. A malicious user could send a specially crafted object (e.g., `{$ne: null}`) as the 'id' through a Socket.IO client. This object would be interpreted as a query operator by MongoDB, allowing the attacker to update all documents in the collection instead of a single one.

MongoDbAdapter.remove

packages/mongodb/src/adapter.ts

The 'remove' method takes an 'id' parameter that is used to construct a MongoDB query. Prior to the patch, this method did not validate the type of the 'id'. A malicious user could send a specially crafted object (e.g., `{$ne: null}`) as the 'id' through a Socket.IO client. This object would be interpreted as a query operator by MongoDB, allowing the attacker to remove all documents in the collection instead of a single one.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.