Skip to content
OpenAdvisories

Package · npm

mongoose

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-125119

    Mongoose: Connection-level sanitizeFilter not applied

    Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditi…

    Automattic mongoose mongoose npm
  • High 8.2
    CVE-2026-125117

    Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

    Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set…

    Automattic mongoose mongoose npm
  • High 7.5
    CVE-2026-42334

    Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

    Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitize…

    Automattic mongoose mongoose npm
  • High 7.0
    CVE-2022-2564 EPSS 31%

    Prototype Pollution in automattic/mongoose

    Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

    Automattic automattic/mongoose mongoose npm