Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: Patches Has the problem been patched? What versions should users upgrade to? 9.7.2, 8.24.1. 7.8.10, 6.13.10 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Check user-controlled updates for own proto properties before passing to Mongoose References Are there any links users can visit to find out more?
Recommended action: Upgrade to 9.7.2, 8.24.1, 7.8.10 or 6.13.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This may lead to: - Authentication bypass - Unauthorized data access - Data exfiltration Affected users: Applications that: - Explicitly enable sanitizeFilter - Pass unsanitized user-controlled input directly into query methods (e.g., Model.findOne(req.body)) and rely on sanitizeFilter to strip out query selectors Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example,…
Recommended action: Upgrade to 9.1.6, 8.22.1, 7.8.9 or 6.13.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Recommended action: Upgrade to 8.9.5, 7.8.4 or 6.13.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
Recommended action: Upgrade to 8.8.3, 7.8.3, 6.13.5 or 5.13.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.
Recommended action: Upgrade to 7.3.3, 6.11.3 or 5.13.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack. Proof of Concept Impact This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.
Recommended action: Upgrade to 6.4.6 or 5.13.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.
Recommended action: Upgrade to 6.4.6 or 5.13.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. Recommendation Update to version 4.3.6, 3.8.39 or later.
Recommended action: Upgrade to 4.3.6 or 3.8.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Recommended action: Upgrade to 5.7.5 or 4.13.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.