@feathersjs feathers

• CVE-2026-54335 Low 3.7 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ 0.4%
• CVE-2026-29792 Critical 9.3 Feathersjs has an OAuth Callback Account Takeover 0.6%
• CVE-2026-27193 High 8.2 Feathers exposes internal headers via unencrypted session cookie 0.4%
• CVE-2026-27192 High 7.6 Feathers has an origin validation bypass via prefix matching 0.3%
• CVE-2026-27191 High 7.4 Feathers: Open Redirect in OAuth callback enables account takeover 0.3%
• CVE-2023-37899 High 7.5 feathersjs socket handler allows abusing implicit toString 1.2%