CVE-2026-29793: NoSQL Injection in Feathers MongoDB Adapter

CVE-2026-29793 is a critical flaw (CVSS 9.8) in the Feathers MongoDB adapter. In versions 5.0.0 through 5.0.41, a Socket.IO client can send an object instead of an ID to service methods, and the object reaches the database query as operators. Upgrade @feathersjs/mongodb to 5.0.42.

What's affected

The GitHub advisory lists @feathersjs/mongodb versions 5.0.0 through 5.0.41 as affected and 5.0.42 or later as patched. The NVD text covers Feathers 5.0.0 to before 5.0.42.

You are in scope if your Feathers app uses the MongoDB adapter and exposes services over Socket.IO. The advisory says the transport layer does no type checking on the id argument of get, patch, update and remove.

How to check if you're exposed

Check each service for the adapter and its version:

npm ls @feathersjs/mongodb
npm ls @feathersjs/socketio

Search your code for services created with MongoDBService and see whether the Socket.IO transport is configured in your app. Services that only use REST are described differently in the advisory, so read it for your setup. Look for hooks that validate id types before they reach the adapter.

What to do now

1. Upgrade @feathersjs/mongodb to 5.0.42 or later and redeploy.
2. Confirm the running build uses the new version with npm ls @feathersjs/mongodb.
3. As defence in depth, add schema or hook validation so that id must be a string or ObjectId before a service method runs.
4. Review access logs for service calls with unusual id values, and check data for unexpected changes in collections that clients could reach.
5. Re-scan your dependencies after upgrading. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.

Why it matters

This is a query logic injection, classed as CWE-943, improper neutralization of special elements in data query logic. A value that should be a plain identifier is accepted as an object. MongoDB treats keys that start with a dollar sign as operators, so a crafted object can change what the query matches. The advisory gives the example that an operator for not equal to null matches every document in the collection.

That turns a single record lookup into an operation across the whole collection, for methods that read, change or delete data. The fix is to enforce types at the boundary. If your own services accept ids from clients, it is worth checking they do the same. The record does not mark this CVE as exploited in the wild.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-p9xr-7p9p-gpqx

Last reviewed: 19 October 2026.