Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

DEBIAN-CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

DEBIAN-CVE-2026-73254

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

DEBIAN-CVE-2026-73257

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

CVE-2026-73254

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

DEBIAN-CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

CVE-2026-73257

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

DEBIAN-CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-73251

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tlsbuiltin.c, the mgtlsinit function stores the bundle in tls-cabundleder while tls-cader.len remains...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

EUVD-2026-63500

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...