CVE-2023-37899— feathersjs socket handler allows abusing implicit toString
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-37899
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
feathersjs socket handler allows abusing implicit toString
Source: CVE Program / CVE List V5
Vulnerability Description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5
Vulnerability Title
Feathers 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Feathers是Feathers开源的一个轻量级的 Web 框架。用于使用 TypeScript 或 JavaScript 创建 API 和实时应用程序。 Feathers存在代码问题漏洞，该漏洞源于套接字处理程序没有捕获无效的字符串转换错误，这会导致NodeJS进程在发送意外消息时崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| feathersjs | feathers | < 4.5.18 | - |
II. Public POCs for CVE-2023-37899
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 4994 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2023-37899
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-37899 (2)
- https://github.com/feathersjs/feathers/pull/3241x_refsource_MISC
- https://github.com/feathersjs/feathers/pull/3242x_refsource_MISC
Vendor Advisories for CVE-2023-37899 (1)
Other References for CVE-2023-37899 (2)
IV. Related Vulnerabilities
Same product: feathers
- CVE-2026-54335
Feathersjs: Prototype pollution in @feathersjs/commons _.mer - CVE-2026-29792
Feathersjs has an OAuth Callback Account Takeover - CVE-2026-27193
Feathers exposes internal headers via unencrypted session co - CVE-2026-27192
Feathers has an origin validation bypass via prefix matching - CVE-2026-27191
Feathers: Open Redirect in OAuth callback enables account ta
Same vendor: feathersjs
- CVE-2026-54335
Feathersjs: Prototype pollution in @feathersjs/commons _.mer - CVE-2026-29792
Feathersjs has an OAuth Callback Account Takeover - CVE-2026-27193
Feathers exposes internal headers via unencrypted session co - CVE-2026-27192
Feathers has an origin validation bypass via prefix matching - CVE-2026-27191
Feathers: Open Redirect in OAuth callback enables account ta
Same weakness: CWE-754
- CVE-2026-0667
Schneider Electric SCADAPack 47x 异常处理不当漏洞 - CVE-2026-65904
DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mo - CVE-2026-44621
Libunbound applications configured with 'unwanted-reply-thre - CVE-2026-63754
SurrealDB before 3.1.0 Denial of Service via LIVE Query - CVE-2026-21764
Insufficient Input Validation in DevOps Loop
V. Comments for CVE-2023-37899
No comments yet