3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54335

CVE-2026-54335: Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed proto

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a proto, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['proto'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54335

CVE-2026-54335:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@feathersjs/commons	npm	<= 5.0.44	5.0.45

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the merge utility function within @feathersjs/commons. This function recursively merges properties from a source object into a target object. The vulnerability, a form of prototype pollution, occurs because the function does not properly sanitize the keys from the source object before merging. When a malicious source object, often created from JSON.parse, contains a __proto__ key, the merge function would recursively merge the provided properties onto Object.prototype. This pollutes the prototype of all standard JavaScript objects in the Node.js process. The patch, identified in commit 28b3c03c63bdbff53115fdaa46c56980e7942acc, remediates this by explicitly checking for and skipping the keys __proto__, constructor, and prototype during the merge operation, preventing the prototype pollution.

Vulnerable functions

merge

packages/commons/src/utils.ts

The `merge` function is vulnerable to prototype pollution. It iterates over the keys of the `source` object and merges them into the `target` object. Before the patch, there was no check to prevent malicious keys like `__proto__`, `constructor`, or `prototype` from being processed. An attacker could provide a JSON-parsed object with a `__proto__` key, which would lead to the modification of `Object.prototype`, affecting all objects in the application. The patch adds a check to skip these specific keys, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.