CVE-2026-54335: Feathersjs Prototype Pollution Vulnerability

CVE-2026-54335 Overview

CVE-2026-54335 is a prototype pollution vulnerability [CWE-1321] in the Feathers.js framework, specifically in the @feathersjs/commons package. The _.merge(target, source) utility recursively merges properties from a source object into a target using Object.keys(source). When the source originates from JSON.parse and contains a __proto__, constructor, or prototype key, the merge writes attacker-controlled values onto Object.prototype. The pollution persists for the lifetime of the Node.js process and affects every plain object created afterward. All versions of Feathers.js up to and including 5.0.44 are affected, with the fix released in 5.0.45.

Critical Impact
Successful exploitation pollutes Object.prototype process-wide, enabling downstream integrity impact against any application logic that relies on default object properties.

Affected Products

Feathers.js @feathersjs/commons versions 5.0.44 and earlier
Node.js applications using the Feathers.js framework for web APIs
Real-time applications built on Feathers.js with TypeScript or JavaScript

Discovery Timeline

2026-07-17 - CVE-2026-54335 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54335

Vulnerability Analysis

The vulnerability resides in the merge function exported by @feathersjs/commons. The function iterates over Object.keys(source) and recursively assigns values to matching keys in target. JavaScript treats __proto__, constructor, and prototype as own-enumerable properties when they appear in an object produced by JSON.parse. When the merge encounters __proto__, target['__proto__'] resolves to Object.prototype, and the recursive assignment writes attacker-controlled properties onto the global prototype chain.

Once polluted, every plain object created within the Node.js process inherits the injected properties. Downstream effects depend on the application, but can include altering conditional checks, injecting fields into serialized responses, or corrupting configuration lookups. The issue is fixed in version 5.0.45.

Root Cause

The root cause is missing key filtering in the recursive merge routine. The pre-patch implementation did not exclude JavaScript's special property keys before assignment. Because JSON.parse preserves __proto__ as an own property (unlike object literal syntax), any HTTP endpoint that parses JSON input and forwards it into _.merge propagates the pollution.

Attack Vector

An unauthenticated attacker submits a JSON payload containing a __proto__ object to any Feathers.js endpoint that merges request data using the vulnerable utility. The attack is remote but requires high complexity, as the attacker must identify a code path that funnels untrusted JSON into the merge function. The patch below closes the sink by skipping the dangerous keys.

typescript

   merge(target: any, source: any) {
     if (_.isObject(target) && _.isObject(source)) {
       Object.keys(source).forEach((key) => {
+        // Skip prototype-polluting keys (e.g. JSON-parsed `__proto__`)
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          return
+        }
         if (_.isObject(source[key])) {
           if (!target[key]) {
             Object.assign(target, { [key]: {} })

Source: Feathers.js commit 28b3c03

Detection Methods for CVE-2026-54335

Indicators of Compromise

HTTP request bodies containing __proto__, constructor, or prototype keys in JSON payloads submitted to Feathers.js endpoints
Unexpected properties appearing on plain objects returned by API responses after a burst of anomalous requests
Runtime errors or altered application behavior following requests that include nested JSON with reserved prototype keys

Detection Strategies

Inspect application dependency manifests for @feathersjs/commons versions at or below 5.0.44
Add web application firewall or reverse-proxy rules that flag JSON bodies containing __proto__, constructor.prototype, or prototype keys
Enable Node.js runtime logging around merge operations and audit request handlers that call _.merge on user input

Monitoring Recommendations

Log and alert on 4xx/5xx spikes from Feathers.js services following payloads with reserved keys
Track outbound API response deltas that suggest unexpected default properties on serialized objects
Correlate anomalous JSON parsing telemetry with authentication and session logs to identify targeted probes

How to Mitigate CVE-2026-54335

Immediate Actions Required

Upgrade @feathersjs/commons and the Feathers.js framework to version 5.0.45 or later
Audit all custom middleware and service hooks that pass request payloads into merge or extend utilities
Redeploy running Node.js processes after upgrading, since prototype pollution persists in memory until restart

Patch Information

The fix is available in Feathers.js 5.0.45, which explicitly filters __proto__, constructor, and prototype keys during recursive merges. Review the GitHub Security Advisory GHSA-28xv-ph75-77wh, the pull request #3690, and the v5.0.45 release notes for full details.

Workarounds

Sanitize JSON request bodies at the HTTP boundary to strip __proto__, constructor, and prototype keys before they reach service handlers
Freeze Object.prototype at process startup using Object.freeze(Object.prototype) where application compatibility allows
Replace calls to the vulnerable _.merge utility with a hardened merge implementation that filters reserved keys

bash

# Upgrade Feathers.js commons to the patched release
npm install @feathersjs/commons@^5.0.45
npm ls @feathersjs/commons