Feathersjs, a framework for web APIs and real-time applications, uses a _.merge utility in @feathersjs/commons that recursively merges source objects into target objects by iterating Object.keys(source). When the source object is parsed from JSON and contains keys like __proto__, constructor, or prototype, these keys become enumerable own properties. The recursive merge then writes attacker-supplied properties onto Object.prototype, causing prototype pollution that persists for the lifetime of the Node.js process. This vulnerability affects versions 5.0.44 and earlier and is resolved in version 5.0.45.

An attacker can modify the prototype of all plain objects in the Node.js process by injecting properties via specially crafted JSON input. This can lead to unexpected behavior or logic errors in applications using feathersjs, though no direct confidentiality or availability impact is indicated. The CVSS score of 3.7 reflects a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on integrity only.

Upgrade feathersjs to version 5.0.45 or later, where this prototype pollution vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix in 5.0.45.