Skip to main content
cve.nowby Sazabi
← npm
npmPackage

mongoose

7 known vulnerabilities (3 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 3 critical, 2 high, 1 medium
Weekly downloads
8.9M
Dependents
1,602
Registry
npm

Advisories 7

  • CVE-2026-73562Medium 6.5

    Mongoose: Prototype pollution in the update casting via proto-prefixed dotted path (Schema._getSchema/path getter)

    Affected: fixed in 6.13.10; from 7.0.0, fixed in 7.8.10; from 8.0.0, fixed in 8.24.1; from 9.0.0, fixed in 9.7.2.

  • Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

    Affected: fixed in 6.13.9; from 7.0.0, fixed in 7.8.9; from 8.0.0, fixed in 8.22.1; from 9.0.0, fixed in 9.1.6.

  • CVE-2025-23061Critical 9.0

    Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.

    Affected: from 8.0.0-rc0, fixed in 8.9.5; from 7.0.0-rc0, fixed in 7.8.4; fixed in 6.13.6.

  • CVE-2024-53900Critical 9.1

    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

    Affected: from 8.0.0-rc0, fixed in 8.8.3; from 7.0.0-rc0, fixed in 7.8.3; from 6.0.0-rc0, fixed in 6.13.5; from 3.6.0-rc0, fixed in 5.13.23.

  • CVE-2023-3696Critical 10.0

    Prototype Pollution in automattic/mongoose

    Affected: from 7.0.0, fixed in 7.3.3; from 6.0.0, fixed in 6.11.3; fixed in 5.13.20.

  • Prototype Pollution in automattic/mongoose

    Affected: from 6.0.0, fixed in 6.4.6; fixed in 5.13.15.

  • Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a…

    Affected: from 5.0.0, fixed in 5.7.5; fixed in 4.13.21.