feathersjs feathers up to 5.0.44 Merge merge prototype insufficient precision or accuracy of a real number

Summaryinfo

A vulnerability classified as critical was found in feathersjs feathers up to 5.0.44. This issue affects the function merge of the component Merge. Such manipulation of the argument prototype leads to insufficient precision or accuracy of a real number. This vulnerability is listed as CVE-2026-54335. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in feathersjs feathers up to 5.0.44. It has been rated as critical. Affected by this issue is the function merge of the component Merge. The manipulation of the argument prototype with an unknown input leads to a insufficient precision or accuracy of a real number vulnerability. Using CWE to declare the problem leads to CWE-1339. The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54335 since 06/12/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 5.0.45 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• feathersjs

Name

• feathers

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.0.16
• 5.0.17
• 5.0.18
• 5.0.19
• 5.0.20
• 5.0.21
• 5.0.22
• 5.0.23
• 5.0.24
• 5.0.25
• 5.0.26
• 5.0.27
• 5.0.28
• 5.0.29
• 5.0.30
• 5.0.31
• 5.0.32
• 5.0.33
• 5.0.34
• 5.0.35
• 5.0.36
• 5.0.37
• 5.0.38
• 5.0.39
• 5.0.40
• 5.0.41
• 5.0.42
• 5.0.43
• 5.0.44

Website

• Product: https://github.com/feathersjs/feathers/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion