Feathersjs version 5.0.39 and earlier store every HTTP request header in the session cookie. The cookie is signed but not encrypted; base64 decoding exposes the entire headers object, including internal proxy, gateway, and OAuth service headers. The leaked data may contain sensitive API keys, service tokens, or internal IP addresses, thereby compromising confidentiality. This flaw is categorized as a data confidentiality weakness.

The vulnerability affects the Feathersjs framework, particularly node.js applications using feathers version 5.0.39 or earlier. Deployments that pass through reverse proxies or API gateways may inadvertently expose additional internal details through the unencrypted session data.

The CVSS score is 8.2, indicating a high severity. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low current exploitation probability. Based on the description, an attacker who can obtain a client’s session cookie—whether through browser interception, cross‑site request forgery, or other client‑side attacks—is inferred to be able to decode it and read the exposed headers. Based on the description, the lack of encryption and the fact that the cookie is only signed is inferred to make the attack vector straightforward for remote attackers with access to the client or network traffic.