EUVD-2026-120502

Mongoose: Connection-level sanitizeFilter not applied...

CVE-2026-125119

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions and query casting check other optio...

CVE-2026-125119

The Mongoose MongoDB object modeling tool is vulnerable to a security bypass because it fails to correctly read the connection-level sanitizeFilter option. From versions 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, the tool stores this option in Connection.config, but the query casting logic ...

PT-2026-141174

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype. castConditions and query casting check other opti...