NPM · SEPTEMBER 2026 · EARLY WARNING

Feast npm Package Vulnerability: Critical CVE-2026-92787 Under Investigation

Q: Am I affected?

You are affected if you are using Feast npm package version 0.0.1 to 0.66.0.

Q: What should I do right now?

Check your Feast npm package version and upgrade if necessary. Monitor primary sources for updates on a patched version.

Q: Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates.

Q: How severe is this vulnerability?

The vulnerability is rated as CRITICAL with a CVSS score of 9.8.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.8
Affected component: feast (npm)
Affected versions: >= v0.66.0, <= v0.66.0 or >= v0.65.0, <= v0.65.0 or >= v0.64.0, <= v0.64.0 or >= v0.63.0, <= v0.63.0 or >= v0.62.0, <= v0.62.0 or >= v0.60.0, <= v0.60.0 or >= v0.59.0, <= v0.59.0 or >= v0.58.0, <= v0.58.0 or >= v0.54.0, <= v0.54.0 or >= v0.57.0, <= v0.57.0 or >= v0.56.0, <= v0.56.0 or >= v0.55.0, <= v0.55.0 or >= v0.53.0, <= v0.53.0 or >= v0.52.0, <= v0.52.0 or >= v0.51.0, <= v0.51.0 or >= v0.50.0, <= v0.50.0 or >= v0.49.0, <= v0.49.0 or >= v0.48.0, <= v0.48.0 or >= v0.47.0, <= v0.47.0 or >= v0.46.0, <= v0.46.0 or >= v0.45.0, <= v0.45.0 or >= v0.44.0, <= v0.44.0 or >= v0.43.0, <= v0.43.0 or >= v0.42.0, <= v0.42.0 or >= v0.41.0, <= v0.41.0 or >= v0.40.0, <= v0.40.0 or >= v0.39.0, <= v0.39.0 or >= v0.38.0, <= v0.38.0 or >= v0.37.0, <= v0.37.0 or >= v0.36.0, <= v0.36.0 or >= v0.35.0, <= v0.35.0 or >= v0.34.0, <= v0.34.0 or >= v0.33.0, <= v0.33.0 or >= v0.32.0, <= v0.32.0 or >= v0.31.0, <= v0.31.0 or >= v0.30.0, <= v0.30.0 or >= v0.29.0, <= v0.29.0 or >= v0.28.0, <= v0.28.0 or >= v0.27.0, <= v0.27.0 or >= v0.26.0, <= v0.26.0 or >= v0.25.0, <= v0.25.0 or >= v0.24.0, <= v0.24.0 or >= v0.23.0, <= v0.23.0 or >= v0.22.0, <= v0.22.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.0, <= v0.20.0 or >= v0.19.0, <= v0.19.0 or >= v0.18.0, <= v0.18.0 or >= v0.17.0, <= v0.17.0 or >= v0.16.0, <= v0.16.0 or >= v0.14.0, <= v0.14.0 or >= v0.13.0, <= v0.13.0 or >= v0.12.0, <= v0.12.0 or >= v0.11.0, <= v0.11.0 or >= v0.10.0, <= v0.10.0 or >= v0.9.0-rc.2, <= v0.9.0-rc.2 or >= v0.9.0-rc.1, <= v0.9.0-rc.1 or >= v0.8.0, <= v0.8.0 or >= sdk/go/v0.8.0, <= sdk/go/v0.8.0 or >= v0.8.0-rc.3, <= v0.8.0-rc.3 or >= v0.8.0-rc.2, <= v0.8.0-rc.2 or >= v0.8.0-rc.1, <= v0.8.0-rc.1 or >= v0.6.0, <= v0.6.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.2, <= v0.4.2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.2, <= v0.3.2 or >= v0.3.0, <= v0.3.0 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0 or >= v0.0.1, <= v0.0.1
Patched version: Not yet available

CVE-2026-92787

An early warning has been issued for a critical vulnerability in the Feast npm package. Versions from 0.0.1 to 0.66.0 are reportedly affected.

What happened

Feast versions from 0.0.1 to 0.66.0 appear to fail to verify JWT token signatures before establishing user identity. This vulnerability, tracked as CVE-2026-92787, allows attackers to bypass all role-based access control. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server. The vulnerability was first flagged on 2026-09-16T21:17:28.023000+00:00 and is currently under investigation.

There is no evidence that this vulnerability has been exploited in the wild. It is crucial for users of the Feast npm package to assess their exposure and take immediate action to mitigate potential risks.

What to do about it

Check your Feast npm package version against the affected range from 0.0.1 to 0.66.0.
If your version is within the affected range, upgrade to a version that includes the fix for verifying JWT token signatures.
Monitor the primary sources for updates on a patched version.
Implement additional security measures to protect your server from unauthorized access.
Review your access control policies and ensure they are correctly configured.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If feast is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Feast npm package version 0.0.1 to 0.66.0.

What should I do right now?

Check your Feast npm package version and upgrade if necessary. Monitor primary sources for updates on a patched version.

Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates.

How severe is this vulnerability?

The vulnerability is rated as CRITICAL with a CVSS score of 9.8.

Sources

[CVE-2026-92787] CVSS 9.8 CRITICAL

Join the 0Day waitlist →

← Back to all threats