Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54335 · Microsoft / collected KEV context

GHSA-28xv-ph75-77wh

cve-program · CVE-2026-54335

• https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh
• https://github.com/feathersjs/feathers/pull/3690
• https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc
• https://github.com/feathersjs/feathers/releases/tag/v5.0.45

nvd · CVE-2026-54335

• https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc
• https://github.com/feathersjs/feathers/pull/3690
• https://github.com/feathersjs/feathers/releases/tag/v5.0.45
• https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh

osv · GHSA-28xv-ph75-77wh

• https://github.com/feathersjs/feathers/security/advisories/GHSA-28xv-ph75-77wh
• https://github.com/feathersjs/feathers/pull/3690
• https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc
• https://github.com/feathersjs/feathers
• https://github.com/feathersjs/feathers/releases/tag/v5.0.45

No related operational record is retained in the current change model.