https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29793.htmlhttps://patchthecve.com/cve/CVE-2026-29793.htmlWed, 17 Jun 2026 10:29:53 +0000CRITICAL 9.8: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type https://patchthecve.com/cve/CVE-2026-29792.htmlhttps://patchthecve.com/cve/CVE-2026-29792.htmlWed, 17 Jun 2026 10:29:53 +0000CRITICAL 9.8: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authehttps://patchthecve.com/cve/CVE-2026-27193.htmlhttps://patchthecve.com/cve/CVE-2026-27193.htmlWed, 17 Jun 2026 10:26:49 +0000MEDIUM 5.3: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service https://patchthecve.com/cve/CVE-2026-27192.htmlhttps://patchthecve.com/cve/CVE-2026-27192.htmlWed, 17 Jun 2026 10:26:49 +0000HIGH 8.1: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origihttps://patchthecve.com/cve/CVE-2026-27191.htmlhttps://patchthecve.com/cve/CVE-2026-27191.htmlWed, 17 Jun 2026 10:26:49 +0000MEDIUM 6.1: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to ful