CVE-2026-125120

A flaw was found in Mongoose. The countDocuments function fails to apply the configured sanitizeFilter defense against query selector injection. A remote attacker could exploit this flaw by passing crafted filter queries containing database operator objects instead of literal values. Consequently...