Mongoosejs Mongoose vulnerabilities

CVE-2024-53900 [CRITICAL] CWE-89 CVE-2024-53900: Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

CVE-2025-23061 [CRITICAL] CVE-2025-23061: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

CVE-2022-2564 [CRITICAL] CWE-1321 CVE-2022-2564: Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

CVE-2019-17426 [CRITICAL] CVE-2019-17426: Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) b Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versio

CVE-2026-42334 [HIGH] CWE-74 CVE-2026-42334: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to

CVE-2023-3696 [CRITICAL] CWE-1321 CVE-2023-3696: Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.