@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27192 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)

@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27192 Source advisory: OSV:GHSA-MP4X-C34X-WV3X...

Open Redirect

Overview @feathersjs/authentication-oauth is an oAuth 1 and 2 authentication for Feathers. Powered by Grant. Affected versions of this package are vulnerable to Open Redirect due to the improper validation of redirect query parameter. An attacker can obtain a victim's access token and impersonate...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27191 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)

@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27191 Source advisory: OSV:GHSA-PPF9-4FFW-HH4P...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +4 more potentially affected by CVE-2026-27191 via @feathersjs/authentication-oauth (>=5.0.0-pre.10, <=5.0.12)

@feathersjs/authentication-oauth NPM version =5.0.0-pre.10, =2.0.4, =0.5.0, =0.5.4, =0.0.1, =2.0.4 Source cves: CVE-2026-27191 Source advisory: SNYK:JS-FEATHERSJSAUTHENTICATIONOAUTH-15325872...

EUVD-2023-2077

Malicious code in bioql PyPI...

CVE-2023-37899

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

Denial Of Service (DoS)

@feathersjs/transport-commons is vulnerable to Denial of Service DoS attacks. The vulnerability is due to invalid string conversions such as $ toString: '' , which causes the Feathers socket handler to crash the NodeJS process because its unable to handle invalid string conversions...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +2 more potentially affected by CVE-2023-37899 via @feathersjs/transport-commons (>=5.0.0-pre.9, <=5.0.5)

@feathersjs/transport-commons NPM version =5.0.0-pre.9, =0.4.11, =0.5.4, =0.5.8 Source cves: CVE-2023-37899 Source advisory: OSV:GHSA-HHR9-RH25-HVF9...

@xr3ngine/client-core (>=0.2.15, <=0.2.18), @xr3ngine/client-ml (>=0.2.15, <=0.2.18) +1 more potentially affected by CVE-2023-37899 via @feathersjs/socketio (>=4.5.9, <=4.5.11)

@feathersjs/socketio NPM version =4.5.9, =0.2.15, =0.2.15, =0.2.18 - @xr3ngine/server-core 0.2.14 Source cves: CVE-2023-37899 Source advisory: OSV:GHSA-HHR9-RH25-HVF9...

CVE-2023-37899

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

Design/Logic Flaw

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

CVE-2023-37899 feathersjs socket handler allows abusing implicit toString

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

CVE-2023-37899

CVE-2023-37899 concerns Feathersjs: the socket handler fails to catch invalid string conversion errors (e.g., a crafted toString object), causing Node.js to crash on unexpected Socket.io messages. A fix is available in Feathers versions 5.0.8 and 4.5.18; users should upgrade. There is no known wo...

CVE-2023-37899 feathersjs socket handler allows abusing implicit toString

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

CVE-2023-37899 feathersjs socket handler allows abusing implicit toString

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

CVE-2023-37899: Improper Check for Unusual or Exceptional Conditions

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

PT-2023-26168 · Unknown · Feathersjs

Name of the Vulnerable Software and Affected Versions: Feathersjs versions prior to 4.5.18 Feathersjs versions prior to 5.0.8 Description: The Feathers socket handler did not catch invalid string conversion errors, which could cause the NodeJS process to crash when sending an unexpected Socket.io...