Skip to main content

Improper Check for Unusual or Exceptional Conditions


Severity High
Score 7.5/10


Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected message like `socket.emit('find', { toString: '' })`. This vulnerability affects packages "@feathersjs/transport-commons" and "@feathersjs/socketio" versions prior to 4.5.18 and 5.x prior to 5.0.8. Users are advised to upgrade. There is no known workaround for this vulnerability.

  • LOW
  • NONE
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-754 - Improper Check for Unusual or Exceptional Conditions

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

Advisory Timeline

  • Published