Skip to content
OpenAdvisories

Package · npm

mongoose

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    CVE-2025-23061 Public exploit

    Mongoose search injection vulnerability

    Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

    mongoosejs Mongoose mongoose npm
  • Critical 9.1
    CVE-2024-53900 Public exploit

    Mongoose search injection vulnerability

    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

    mongoose npm