CyberRota Analysis
AI-GeneratedThe vulnerability affects the Feathersjs framework, specifically in versions 5.0.44 and earlier, where the _.merge utility can be exploited to manipulate the prototype of all plain objects in the Node process. This occurs when an attacker supplies a source object containing certain keys, leading to potential prototype pollution and unintended behavior in applications. Developers using affected versions of Feathersjs should prioritize updating to version 5.0.45 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.