NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
CRITICAL severity

Feather-Sequelize cleanQuery method vulnerable to Prototype PollutionGHSA-p5m3-27vh-52j4

CRITICALFix: feathersjs-ecosystem/feathers-sequelize@0b7beaa

GHSA-p5m3-27vh-52j4 is a critical-severity (CVSS 9.8) CWE-1321 vulnerability in feathers-sequelize. A fix is available for feathers-sequelize — see the affected versions and patch details below.

Also known asCVE-2022-29823
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.8%probability of exploitation in next 30 days
Lower Risk+0.30%
Lower risk than most CVEs79th percentile — riskier than 79% of all scored CVEsHighest risk
0.85%2.07%3.30%4.53%3.8%1.5%1.8%May 26Oct 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

40other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
feathers-sequelizenpm
20Kdownloads / week

Description

Feather-Sequelize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmfeathers-sequelize≥ 6.0.0&&< 6.3.36.3.3npm install feathers-sequelize@6.3.3

Affected Products

1 product · 1 configurations
Application
feathers-sequelizefeathersjs
≥ 6.0.0 && < 6.3.4
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for feathers-sequelize, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update feathers-sequelize to 6.3.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p5m3-27vh-52j4 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

Feather-Sequelize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
O3 Security · Impact-Aware SCA

Is GHSA-p5m3-27vh-52j4 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Feather-Sequelize cleanQuery method vulnerable to…