CVE-2026-125120

The Mongoose MongoDB object modeling tool is vulnerable to a query selector injection issue in versions prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2 . The countDocuments() function fails to apply the configured sanitizeFilter defense, allowing an attacker to provide query operator objects that are...

PT-2026-141175

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.11 Mongoose versions prior to 7.8.12 Mongoose versions prior to 8.24.3 Mongoose versions prior to 9.9.2 Description Mongoose is a MongoDB object modeling tool for asynchronous environments. The countDocuments...