Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.8 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

• CVE-2026-125116: 0.34% estimated exploitation activity in the next 30 days; percentile 27.55 (FIRST EPSS, 2026-11-10). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (`t` by default) in a plain object of registered discriminators, for example `Model.discriminators[doc.t]`. That value comes from user documents and query filters. Because the lookup did not check own properties, a value that names a property inherited from `Object.prototype` resolves to that inherited value instead of a discriminator. Examples are `'constructor'`, `'toString'` and `'hasOwnProperty'`. - `t: 'constructor'` resolves to the global `Object` function. Mongoose then calls `new Object(doc)`, which returns the raw user object where a Mongoose document is expected. - `t: 'toString'` and similar names resolve to built-in functions that throw when used as a constructor or schema. The most serious effect: through `bulkWrite()` `insertOne` with `skipValidation: true`, the raw user object is stored as-is, without schema casting or `strict` filtering. After…

Published by the source

10 Nov 2026, 20:57 UTC

Last modified by the source

10 Nov 2026, 21:15 UTC

Source last checked

11 Nov 2026, 06:00 UTC

1. Revision 2 · amended · 11 Nov 2026

   Amended from osv record GHSA-wr5m-5jph-8m96

2. Revision 1 · created · 10 Nov 2026

   Published from ghsa record GHSA-wr5m-5jph-8m96

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-125116

Advisory: Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
IDs: CVE-2026-125116, GHSA-wr5m-5jph-8m96
Record: https://patchnext.com/advisories/cve-2026-125116 (revision 2, source checked 11 Nov 2026, 06:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: mongoose 9.11.4, 8.24.7, 7.8.13, 6.13.12. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm mongoose: affected < 6.13.12; >= 7.0.0, < 7.8.13; >= 8.0.0, < 8.24.7; >= 9.0.0, < 9.11.4; fixed in 6.13.12, 7.8.13, 8.24.7, 9.11.4

## Suggested inspection (read-only)
- `npm ls mongoose --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on mongoose.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-wr5m-5jph-8m96 (GitHub-reviewed advisory GHSA-wr5m-5jph-8m96 lists affected ranges: npm mongoose >=0 =7.0.0 =8.0.0 =9.0.0 <9.11.4)
- Verified: https://osv.dev/vulnerability/GHSA-wr5m-5jph-8m96 (OSV record GHSA-wr5m-5jph-8m96 lists affected ranges: npm mongoose >=0 =7.0.0 =8.0.0 =9.0.0 <9.11.4 (fixed))

Commands are suggestions: review each one before running it.