mongoosejs vulnerabilities

Products

• mongoose 6

Latest mongoosejs CVEs

Newest publication first

1. CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

   Published 2026-05-14

   High·CVSS 7.5 EPSS 0.27%

   Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mo...

2. CVE-2025-23061 Mongoose search injection vulnerability

   Published 2025-01-15

   Critical·CVSS 9.8 EPSS 7.2%

   Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

3. CVE-2024-53900 Mongoose search injection vulnerability

   Published 2024-12-02

   Critical·CVSS 9.1 EPSS 4.0%

   Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

4. CVE-2023-3696 Prototype Pollution in automattic/mongoose

   Published 2023-07-17

   Critical·CVSS 9.8 EPSS 1.2%

   Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

5. CVE-2022-2564 Prototype Pollution in automattic/mongoose

   Published 2022-07-28

   Critical·CVSS 9.8 EPSS 31.3%

   Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

6. CVE-2019-17426 Improper Input Validation in Automattic Mongoose

   Published 2019-10-10

   Critical·CVSS 9.1 EPSS 1.5%

   Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.