The vulnerability arises when Socket.IO clients send arbitrary JavaScript objects as the id argument to any service method. Because the transport layer does not perform type checking, these objects flow into the MongoDB adapter where getObjectId() inserts them directly into the query as operators. Consequently, an attacker can craft input such as {$ne: null} to match all documents, or other query operators, leading to unauthorized disclosure of all documents in the affected collection. The weakness is a NoSQL injection (CWE-943) that can be leveraged without authentication to read data the attacker is not entitled to access, potentially exposing sensitive information.

This issue affects applications that use FeathersJS version 5.0.0 through 5.0.41 with the MongoDB adapter in a Node.js environment. The specific package is @feathersjs:mongodb. The attack can occur in any deployment that accepts Socket.IO connections to the Feathers services, including those built with TypeScript or JavaScript. Affected products include any FeathersJS-based API or real-time application relying on the MongoDB adapter during that release window.

The CVSS score of 9.3 reflects a severe impact. The EPSS score is below 1 %, indicating the current probability of exploitation is very low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this remotely by connecting to the service via WebSocket and sending a crafted id object, typically with no authentication required. Once the NoSQL injection is successful, the attacker can read entire collections or retrieve sensitive data, potentially causing a major breach of confidentiality and business impact. The only requirement is remote access to the WebSocket endpoint; no special privileges are needed.