CVE-2026-27193 Overview
CVE-2026-27193 is an information disclosure vulnerability in Feathersjs Feathers, a framework for building web APIs and real-time applications in TypeScript or JavaScript. Versions 5.0.39 and below store all HTTP request headers in the session cookie. The cookie-session middleware base64-encodes the data and signs the cookie to prevent tampering, but does not encrypt it. Any client can decode the cookie and read the contents. The OAuth service places the complete headers object into the session, which can expose internal proxy and gateway headers when the application runs behind a reverse proxy or API gateway. The exposed data may include API keys, service tokens, and internal IP addresses. The maintainers resolved the issue in version 5.0.40.
Critical Impact
Clients can decode session cookies to recover internal infrastructure headers, including API keys, service tokens, and internal IP addresses set by upstream proxies.
Affected Products
- Feathersjs Feathers versions 5.0.39 and below (Node.js)
- Applications using the @feathersjs/authentication-oauth service with cookie-session
- Deployments running Feathers behind reverse proxies or API gateways
Discovery Timeline
- 2026-02-21 - CVE-2026-27193 published to NVD
- 2026-02-25 - Last updated in NVD database
Technical Details for CVE-2026-27193
Vulnerability Analysis
The flaw is an Information Exposure issue [CWE-200] in the OAuth authentication flow of Feathersjs Feathers. During the OAuth handshake, the framework serializes the entire incoming HTTP headers object into the session state. The session is then persisted by cookie-session, which serializes the payload to JSON and base64-encodes it before placing it in a signed cookie returned to the client.
The signature protects integrity but not confidentiality. Any party that receives the cookie, including the end user or anyone with access to browser storage, can reverse the base64 encoding and read the raw header values.
In typical production deployments, the request reaches Feathers after passing through a reverse proxy, load balancer, or API gateway. These intermediaries inject headers such as X-Forwarded-For, internal authentication tokens, service mesh identifiers, and gateway-issued API keys. All of these end up inside the cookie. The vulnerability is exploitable without authentication and over the network.
Root Cause
The OAuth service stores the unfiltered headers object on the session. The downstream cookie-session store applies signing but no encryption, so the cookie is effectively a public, tamper-evident record of internal request metadata.
Attack Vector
An attacker initiates an OAuth flow against the target Feathers application and captures the response Set-Cookie header. Decoding the base64-encoded session value yields a JSON object containing every header that the upstream proxy attached to the request. The attacker reads internal hostnames, IP addresses, service-to-service tokens, and any custom gateway headers, then uses that information to pivot or to authenticate directly against internal services.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-9m9c-vpv5-9g85 for the maintainer-supplied technical description.
Detection Methods for CVE-2026-27193
Indicators of Compromise
- Outbound Set-Cookie responses from Feathers OAuth endpoints whose base64-decoded payload contains keys such as x-forwarded-, x-real-ip, authorization, or vendor-specific gateway headers.
- Access logs showing repeated unauthenticated requests to OAuth initiation routes such as /oauth/<provider> followed by no completion of the flow.
- Unexpected reuse of internal service tokens originating from external client IP addresses.
Detection Strategies
- Inspect application responses in pre-production and sample base64-decoded session cookies to confirm whether request headers are present in the payload.
- Compare the running @feathersjs/authentication-oauth package version against 5.0.40 using software composition analysis tooling.
- Review proxy and gateway configurations to enumerate which sensitive headers would be exposed if leaked.
Monitoring Recommendations
- Alert on internal credentials, service tokens, or RFC1918 IP addresses appearing in outbound HTTP responses.
- Track abnormal traffic patterns against OAuth endpoints in Feathers applications.
- Rotate any API keys or service tokens that were previously injected as request headers while a vulnerable version was deployed.
How to Mitigate CVE-2026-27193
Immediate Actions Required
- Upgrade Feathersjs Feathers and the @feathersjs/authentication-oauth package to version 5.0.40 or later.
- Rotate any API keys, service tokens, and internal credentials that upstream proxies may have injected as request headers.
- Audit existing session cookies issued by vulnerable deployments and invalidate active sessions after upgrade.
Patch Information
The fix was released in Feathersjs Feathers version 5.0.40. Review the GitHub Release v5.0.40 notes and the corrective commit ee19a0a, which removes the full headers object from the OAuth session payload.
Workarounds
- Strip sensitive proxy and gateway headers before they reach the Feathers application using upstream proxy rules.
- Replace cookie-session with a server-side session store so that header data is not transmitted to clients.
- Configure the OAuth service to persist only the fields explicitly required for the authentication flow.
# Upgrade Feathers and the OAuth authentication package to the fixed release
npm install @feathersjs/feathers@^5.0.40 @feathersjs/authentication-oauth@^5.0.40
# Verify the installed version
npm ls @feathersjs/feathers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
