CVE-2026-27193

The record

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, then the session is persisted using cookie-session, which base64-encodes the data. While the cookie is signed to prevent tampering, the contents are readable by anyone by simply decoding the base64 value. Under specific deployment configurations (e.g., behind reverse proxies or API gateways), this can lead to exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses. This issue has been fixed in version 5.0.40.

Affected packages

Related vulnerabilities

• GHSA-9m9c-vpv5-9g85 Feathers exposes internal headers via unencrypted session cookie Same vulnerability
• GHSA-wg9x-qfgw-pxhj Feathers has an OAuth Callback Account Takeover issue Also affects @feathersjs/authentication-oauth
• CVE-2026-29792 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
• CVE-2026-27191 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
• CVE-2026-27192 Feathersjs is a framework for creating web APIs and real-time applications with… Also affects @feathersjs/authentication-oauth
• GHSA-mp4x-c34x-wv3x Feathers has an origin validation bypass via prefix matching Also affects @feathersjs/authentication-oauth
• GHSA-ppf9-4ffw-hh4p Feathers has an open redirect in OAuth callback enables account takeover Also affects @feathersjs/authentication-oauth
• CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200