CVE-2026-73562 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

PT-2022-16593

Name of the Vulnerable Software and Affected Versions Mongoose affected versions not specified Description The issue concerns a Prototype Pollution vulnerability in the Schema.path function, allowing modification of the Object prototype. This could lead to a Denial of Service DoS attack. The...

Denial Of Service (DOS)

Mongoose is vulnerable to prototype pollution. The vulnerability is due to the Schema.path function which does not prohibit the setting of the schema object, which can lead to Denial of Service...

automattic/mongoose vulnerable to Prototype pollution via Schema.path

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification...

Possible prototype pollution in Schema.path

Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows...