{"id":"EUVD-2026-45337","revision":null,"records":[{"revision":"f5b29534e22f442d8cb290ac8667137c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54335","aliases":[],"title":"Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__","description":"Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.","state":0,"publishedAt":"2026-07-17T20:56:51.857+00:00","modifiedAt":"2026-07-20T17:38:02.512+00:00","affected":[{"ecosystem":"Vendor product","name":"feathers","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"feathersjs\",\n                    \"product\": \"feathers\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.0.45\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh","https://github.com/feathersjs/feathers/pull/3690","https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc","https://github.com/feathersjs/feathers/releases/tag/v5.0.45"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54335","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54335","identifiers":["CVE-2026-54335"]},"retained":false,"historicalAffected":[]},{"revision":"383ce33f25234a50a739e87366b1a5f3","observedAt":"2026-10-28T08:08:25.531+00:00","statement":{"source":"euvd","id":"EUVD-2026-45337","aliases":["CVE-2026-54335","GHSA-28xv-ph75-77wh"],"title":"Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by it…","description":"Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":null}],"references":["https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh","https://github.com/feathersjs/feathers/pull/3690","https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc","https://github.com/feathersjs/feathers/releases/tag/v5.0.45"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45337","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 17, 2026, 8:56:51 PM","dateUpdated":"Jul 20, 2026, 5:38:02 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-45337","identifiers":["EUVD-2026-45337","CVE-2026-54335","GHSA-28xv-ph75-77wh"]},"retained":false,"historicalAffected":[]},{"revision":"7dbd4a09b9be44a886086af0a1355799","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54335","aliases":[],"title":"Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by it…","description":"Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.","state":0,"publishedAt":"2026-07-17T22:17:44.84+00:00","modifiedAt":"2026-10-24T20:10:00.137+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc","https://github.com/feathersjs/feathers/pull/3690","https://github.com/feathersjs/feathers/releases/tag/v5.0.45","https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54335","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-07-17T22:17:44.840","lastModified":"2026-10-24T20:10:00.137"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54335","identifiers":["CVE-2026-54335"]},"retained":false,"historicalAffected":[]},{"revision":"6540ea068c3e44928da42fe52fb65c33","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-28xv-ph75-77wh","aliases":["CVE-2026-54335"],"title":"Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__","description":"### Impact\n\nThe `_.merge(target, source)` utility exported by `@feathersjs/commons` recursively merges `source` into `target` by iterating `Object.keys(source)`. When `source` was produced by `JSON.parse` and contains a `__proto__` (or `constructor` / `prototype`) key, that key is returned as an own-enumerable property. The recursive merge then resolves `target['__proto__']` to `Object.prototype` and writes the attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process.\n\n**Scope of real-world risk is limited.** No first-party Feathers package routes input — trusted or untrusted — through `commons._.merge`. The `@feathersjs/authentication` package, which does merge request-influenced data, uses `lodash/merge` (prototype-pollution-safe since 4.17.12), not this utility. Exploitation therefore requires a downstream plugin or application to pass JSON-parsed, attacker-controlled input directly through the exported `_.merge`.\n\n### Patches\n\nFixed in `@feathersjs/commons@5.0.45`. The fix skips `__proto__`, `constructor`, and `prototype` keys during iteration — the standard remediation used by lodash and others.\n\n### Workarounds\n\nAvoid passing JSON-parsed untrusted input through `commons._.merge`. Freezing `Object.prototype` or validating/sanitizing keys upstream also mitigates.\n\n### Credit\n\nReported responsibly by Andrew Ridings (@ridingsa).","state":0,"publishedAt":"2026-07-14T19:40:05+00:00","modifiedAt":"2026-07-14T19:56:45.565577+00:00","affected":[{"ecosystem":"npm","name":"@feathersjs/commons","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.0.45"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh","https://github.com/feathersjs/feathers/pull/3690","https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc","https://github.com/feathersjs/feathers","https://github.com/feathersjs/feathers/releases/tag/v5.0.45"],"sourceUrl":"https://github.com/advisories/GHSA-28xv-ph75-77wh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-28xv-ph75-77wh","identifiers":["GHSA-28xv-ph75-77wh","CVE-2026-54335"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T19:55:37.6152917+00:00","complete":true,"records":1762,"lastAttemptAt":"2026-10-28T19:55:37.6152917+00:00","lastSuccessAt":"2026-10-28T19:55:37.8241665+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:37.8242985+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-4d57abdf06616d6d0191287a1c6d6063b1799b0ee009e19f7467660a9a7b6d02","complete":true,"records":416186,"lastAttemptAt":"2026-10-28T19:55:36.5220399+00:00","lastSuccessAt":"2026-10-28T19:47:31.4111083+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:36.5220399+00:00","snapshotPublishedAt":"2026-10-28T19:27:25+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-18805615c98f4ea0af60169c7849918a","complete":true,"records":13441,"lastAttemptAt":"2026-10-28T19:55:45.429381+00:00","lastSuccessAt":"2026-10-28T19:54:53.531+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:54:53.531+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13521,"expectedIdentifiers":13521,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T19:55:37.6152917+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-28T19:55:37.6152917+00:00","lastSuccessAt":"2026-10-28T19:55:42.4850315+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:42.4850326+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f4854efbe24e490d9b23f052f7ac9ade","complete":true,"records":13456,"lastAttemptAt":"2026-10-28T19:55:44.5788139+00:00","lastSuccessAt":"2026-10-28T19:55:44.576+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:44.576+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13521,"expectedIdentifiers":13521,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-db5d28922594478a3b2e1f6f2c9e00b66d7724a8b61997126674985e2fd20048","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T19:55:37.2302322+00:00","lastSuccessAt":"2026-10-28T19:52:43.1700796+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:37.2302322+00:00","snapshotPublishedAt":"2026-10-28T19:33:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T19:55:36.6557004+00:00","lastSuccessAt":"2026-10-28T17:47:26.7464175+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:36.6557004+00:00","snapshotPublishedAt":"2026-10-28T16:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-9cc0e41ed4e75d0c111bed7fd0bbcd4f139c80cc1fc67f8c3d9a33a41da846ad","complete":true,"records":3002,"lastAttemptAt":"2026-10-28T19:55:37.3479553+00:00","lastSuccessAt":"2026-10-28T10:33:32.3653779+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:37.3479553+00:00","snapshotPublishedAt":"2026-10-28T09:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5531769df86ca871948c3446f698d5f6a9cf83e030f57cd055a307e6d4055201","complete":true,"records":230863,"lastAttemptAt":"2026-10-28T19:55:37.1222021+00:00","lastSuccessAt":"2026-10-28T19:52:15.7885389+00:00","error":null,"lastVerifiedAt":"2026-10-28T19:55:37.1222021+00:00","snapshotPublishedAt":"2026-10-28T19:33:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}