NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Vulnerability

Overview

CVE-2026-29793 is a NoSQL injection vulnerability in the FeathersJS framework, affecting versions 5.0.0 through 5.0.41. The root cause lies in the transport layer, which does not validate the type of the id argument sent by Socket.IO clients. When a client sends an arbitrary JavaScript object (e.g., {$ne: null}) as the id parameter to any service method (get, patch, update, remove), the MongoDB adapter passes this object through getObjectId() and directly into the MongoDB query as an operator [1][2].

Exploitation

An unauthenticated attacker can exploit this by sending a specially crafted Socket.IO message containing a MongoDB operator object as the id. No authentication is required because the vulnerability exists in the transport layer before any authorization checks. The attack surface is any FeathersJS application using the MongoDB adapter and exposing Socket.IO endpoints [2].

Impact

By sending {$ne: null} as the id, an attacker can match every document in the targeted collection, effectively bypassing intended access controls. This can lead to unauthorized reading, updating, or deleting of all records in the collection, depending on the service method invoked. The impact is high, as it compromises the confidentiality, integrity, and availability of the data [1][2].

Mitigation

The vulnerability is fixed in FeathersJS version 5.0.42. Users are strongly advised to upgrade to this version or later. No workarounds are documented; the fix involves adding type checking the type of the id argument in the transport layer to reject non-string values [2].