Mongoose patches five flaws enabling injection and prototype pollution

Five critical and high‑risk flaws in Mongoose have been patched across all supported branches, led by CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 (CVSS 8.2), according to SecurityOnline[.]info on 10 November 2026. The bugs enable query injection, app crashes and prototype pollution in Node.js apps that use Mongoose, the MongoDB data modelling tool.

The report notes that five CVEs affect versions older than 6.13.12, 7.0.0–7.8.12, 8.0.0–8.24.6, and 9.0.0–9.11.3, with CVE-2026-125120 impacting builds before 6.13.11, 7.8.12, 8.24.3 and 9.9.2. The article states that there is no confirmed exploitation in the wild at present, though public GitHub reports include working proof‑of‑concept code for four of the bugs (CVE-2026-125116 to CVE-2026-125119) and researchers named koyokr, Linus-Shyu and Fcmam5 reported the flaws to the team.

Details of the attack patterns include filter‑sanitisation bypasses and prototype pollution. CVE-2026-125120 (CVSS 9.8) breaks sanitizeFilter during countDocuments() calls, while CVE-2026-125119 (CVSS 7.5) arises when createClient() moves the sanitizeFilter option into Connection.config.

CVE-2026-125117 (CVSS 8.2) permits overwriting inherited methods during loads, updates and merges, and CVE-2026-125118 (CVSS 6.5) enables prototype pollution in Schema.prototype[.]virtual() due to missing checks for __proto__ and constructor. CVE-2026-125116 (CVSS 4.8) allows discriminator keys like constructor to bypass schema checks during bulk writes.

The advisory urges updating to Mongoose 9.11.4, 8.24.7, 7.8.13 or 6.13.12 immediately, with a fallback option to run a pre‑countDocuments hook or enable sanitizeFilter globally via mongoose[.]set(). The report attributes these mitigations to the Mongoose maintainers.