Skip to content
OpenAdvisories

Package · npm

mongoose

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-125120

    Mongoose: sanitizeFilter not applied on countDocuments

    Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application th…

    Automattic mongoose mongoose npm
  • Critical 9.0
    CVE-2025-23061 Public exploit Scanner template

    Mongoose search injection vulnerability

    Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

    mongoosejs Mongoose mongoose npm
  • Critical 9.1
    CVE-2024-53900 Public exploit Scanner template

    Mongoose search injection vulnerability

    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

    mongoose npm
  • Critical 10.0
    CVE-2023-3696

    Prototype Pollution in automattic/mongoose

    Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

    Automattic automattic/mongoose mongoose npm
  • Critical 9.1
    CVE-2019-17426

    Improper Input Validation in Automattic Mongoose

    Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE …

    mongoose npm