CVE Explorer
CVE-2026-54335
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and write
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"feathers","vendor":"feathersjs","versions":[{"status":"affected","version":"< 5.0.45"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-1321","description":"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc","tags":["x_refsource_MISC"],"url":"https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/references/2
{"name":"https://github.com/feathersjs/feathers/pull/3690","tags":["x_refsource_MISC"],"url":"https://github.com/feathersjs/feathers/pull/3690"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/references/1
{"name":"https://github.com/feathersjs/feathers/releases/tag/v5.0.45","tags":["x_refsource_MISC"],"url":"https://github.com/feathersjs/feathers/releases/tag/v5.0.45"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/references/3
{"name":"https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:b642ae7fd02d7f566c7c01c987d8b190d05a37ec957c067f6bccff1531d4a3cc · sha256:b8bb0b676f65b28e… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.