GHSA-PCRW-H46H-C93H Mongoose: sanitizeFilter not applied on countDocuments

Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...

npm: Mongoose: sanitizeFilter not applied on countDocuments

npm: Mongoose: sanitizeFilter not applied on countDocuments vulnerability discovered by ? in WordPress npm mongoose versions 6.13.11...

Mongoose: sanitizeFilter not applied on countDocuments

Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...

EUVD-2026-120503

Mongoose: sanitizeFilter not applied on countDocuments...

CVE-2026-125120

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes...

CVE-2026-125120

The Mongoose MongoDB object modeling tool is vulnerable to a query selector injection issue in versions prior to 6.13.11 , 7.8.12 , 8.24.3 , and 9.9.2 . The countDocuments() function fails to apply the configured sanitizeFilter defense, allowing an attacker to pass query operator objects as filte...

CVE-2026-125120

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes...

CVE-2026-125120 Mongoose: sanitizeFilter not applied on countDocuments

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes...

CVE-2026-125120: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes...

PT-2026-141175

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.11 Mongoose versions prior to 7.8.12 Mongoose versions prior to 8.24.3 Mongoose versions prior to 9.9.2 Description Mongoose is a MongoDB object modeling tool for asynchronous environments. The countDocuments...