CVE-2026-125116

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

EUVD-2026-120497

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

CVE-2026-125116

The Mongoose MongoDB object modeling tool is vulnerable to type confusion due to the use of attacker-controlled discriminator key values (including the default __t field) to index registries like Model.discriminators. Because Mongoose does not require an own property, values like constructor, toS...

CVE-2026-125116: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...

PT-2026-141160

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries such as Model.discriminators and...