@feathersjs/commons CVE-2026-54335
LOW
GHSA-28xv-ph75-77wh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H because exploitation requires the specific non-default condition of application or plugin code routing untrusted JSON through commons._.merge; I:L only as prototype pollution affects logic integrity but not confidentiality or availability directly.
Primary rating from Vendor (https://github.com/feathersjs/feathers).
CVSS VectorVendor: https://github.com/feathersjs/feathers
Lifecycle Timeline
2DescriptionCVE.org
Impact
The _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__ (or constructor / prototype) key, that key is returned as an own-enumerable property. The recursive merge then resolves target['__proto__'] to Object.prototype and writes the attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process.
Scope of real-world risk is limited. No first-party Feathers package routes input - trusted or untrusted - through commons._.merge. The @feathersjs/authentication package, which does merge request-influenced data, uses lodash/merge (prototype-pollution-safe since 4.17.12), not this utility. Exploitation therefore requires a downstream plugin or application to pass JSON-parsed, attacker-controlled input directly through the exported _.merge.
Patches
Fixed in @feathersjs/commons@5.0.45. The fix skips __proto__, constructor, and prototype keys during iteration - the standard remediation used by lodash and others.
Workarounds
Avoid passing JSON-parsed untrusted input through commons._.merge. Freezing Object.prototype or validating/sanitizing keys upstream also mitigates.
Credit
Reported responsibly by Andrew Ridings (@ridingsa).
AnalysisAI
Prototype pollution in @feathersjs/commons _.merge allows remote attackers to corrupt Object.prototype for the lifetime of a Node.js process by submitting JSON-parsed input containing a __proto__, constructor, or prototype key. The CVSS 3.7 (Low) rating reflects genuine low real-world risk: no first-party @feathersjs/* package routes untrusted input through this specific utility, meaning exploitation is gated on a downstream plugin or custom application code doing so. EPSS is 0.39% (31st percentile) and no public exploit or CISA KEV listing exists, consistent with the vendor's own assessment that scope of real-world risk is limited.
Technical ContextAI
The affected utility is _.merge(target, source) exported from the @feathersjs/commons npm package (pkg:npm/@feathersjs_commons, versions <= 5.0.44). The function recursively merges source into target by iterating Object.keys(source). Because JSON.parse returns __proto__, constructor, and prototype as own-enumerable properties when present in a JSON string, these keys pass through the key iterator unfiltered. When the merge evaluates target['__proto__'], JavaScript resolves this to Object.prototype - the shared prototype of all plain objects - and writes attacker-supplied properties onto it, persisting for the lifetime of the Node process. This is a textbook CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) flaw, the same class that affected lodash prior to 4.17.12. The PR #3690 fix (commit 28b3c03) adds explicit guard checks skipping __proto__, constructor, and prototype keys during iteration, mirroring the standard remediation pattern. Notably, @feathersjs/authentication - the package that does merge request-influenced data - uses lodash/merge (safe since 4.17.12), not this utility.
RemediationAI
Upgrade @feathersjs/commons to version 5.0.45 or later; the patch is confirmed at commit 28b3c03c63bdbff53115fdaa46c56980e7942acc (https://github.com/feathersjs/feathers/commit/28b3c03c63bdbff53115fdaa46c56980e7942acc) and PR #3690 (https://github.com/feathersjs/feathers/pull/3690). If an immediate upgrade is not feasible, audit all application and plugin code for call sites that pass JSON.parse output directly to @feathersjs/commons _.merge and refactor those paths to avoid the unsafe utility. A targeted workaround is to strip or reject __proto__, constructor, and prototype keys from parsed objects before they reach _.merge - this has minimal side effects compared to other options. Freezing Object.prototype at process startup (Object.freeze(Object.prototype)) prevents writes globally but can break third-party libraries that rely on prototype augmentation, so validate thoroughly in a staging environment before deploying. Restarting the Node process clears any active prototype pollution, which can serve as an immediate containment step if exploitation is suspected.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today