CVE-2025-51495

最新リリースのMongoose（v7.17）に確認されたセキュリティ脆弱性を報告します。問題はWebSocketモジュール、特に着信WebSocketフレームを処理するmgwscb関数に存在します。 この関数は整数オーバーフローに対して脆弱であり、特定の細工された入力によってメモリの範囲外アクセスを引き起こす可能性があります。この状態は、リモート攻撃者によって悪用され、メモリ破損やアプリケーションのクラッシュを引き起こす可能性があります。 ベンダーごとにWebSocketのビジネスロジックの実装が異なるため、この脆弱性はリモートコード実行につながる可能性があります。 詳細:...

Mongoose - NoSQL Injection

NoSQL injection vulnerability in Mongoose 8.9.5 affecting the populate function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operator...

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

0xsp-Mongoose

지속적인 개발을 위해 프로젝트를 지원하세요 ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 Windows용 0xsp Mongoose RED 현재 릴리스 2.2.0 0xsp mongoose red 버전은 사이버 보안 시뮬레이션 중 여러분의 요구를 지원하기 위해 제공됩니다. 이 버전을 사용하면 대상 Windows 운영 체제를 감사하여 시스템 취약점, 잘못된 구성 및 권한 상승 공격을 찾아내고 네트워크에서 고급 공격자의 전술과 기술을 복제할 수 있습니다. Node.js 지원을 통한 웹 애플리케이션...

CVE-2024-53900

CTF 챌린지 - Mongoose RCE CVE-2024-53900 챌린지 개요 이 Capture The Flag CTF 챌린지는 Mongoose의 취약점인 CVE-2024-53900을 기반으로 하며, MongoDB 쿼리에서 $where 연산자를 부적절하게 사용하여 원격 코드 실행RCE을 허용합니다. 여러분의 목표는 이 취약점을 악용하여 애플리케이션 내부에 숨겨진 플래그를 검색하는 것입니다! 설정 지침 1 종속성 설치 Node.js가 설치되어 있는지 확인한 후 다음을 실행하세요: root@kitploit: npm install...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

セキュリティアドバイザリ: 未チェックのルーム検索によりサーバークラッシュが発生する Let's Chat 割り当てられたCVE ID: CVE-2026-66749 概要 ログイン済みの任意のアカウントからの1つのHTTPリクエストで、Let's Chatのサーバープロセスが停止します。 GET /messages は room パラメータを受け取り、そのIDでルームを検索し、検索が何も返さなかったかどうかを確認せずに、その結果に対してメソッドを呼び出します。有効な24文字の16進文字列であるものの、どのルームにも属さないIDを送信すると、結果として TypeError...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE 이 저장소는 Mongoose 8.8.3에서 발생하는 심각한 원격 코드 실행RCE 취약점인 CVE-2024-53900 에 대한 재현 가능한 취약 환경과 PoC를 제공합니다. 📌 취약점 세부 정보 CVE : CVE-2024-53900 영향받는 버전 : Mongoose 8.8.3 심각도 : 심각 CVSS 9.1 벡터 : populate.match와 $where의 결합 영향 : Node.js 컨텍스트에서 임의 JavaScript 실행 RCE ...

CVE-2025-23061

CVE-2025-23061 - Mongoose 명령어 삽입 Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 및 CVE-2025-23061 타임라인 2024년 11월 7일: Dat Phung이 Mongoose에서 심각한 취약점을 발견하고 Snyk에 보안 보고서를 제출했습니다. 2024년 11월 26일: Mongoose가 이 취약점을 해결하기 위해 버전 8.8.3을 출시했습니다. 2024년 12월 2일: 미국 국립 취약점 데이터베이스NVD가 이 취약점에 대해 CVE-2024-53900을 공개했습니...

Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

react-mongoose (>=1.0.0, <=1.0.5) potentially affected by unknown CVE via express-mongo-limit (1.0.4)

express-mongo-limit NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on express-mongo-limit and may be impacted: - react-mongoose =1.0.0, =1.0.5 Source cves: unknown CVE Source advisory: SNYK:JS-EXPRESSMONGOLIMIT-19477334...

MAL-2026-15845 Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ROOT-APP-NPM-CVE-2023-3696 CVE-2023-3696 in mongoose - Patched by Root

Root has patched CVE-2023-3696 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-23061 CVE-2025-23061 in mongoose - Patched by Root

Root has patched CVE-2025-23061 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-53900 CVE-2024-53900 in mongoose - Patched by Root

Root has patched CVE-2024-53900 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42334 CVE-2026-42334 in mongoose - Patched by Root

Root has patched CVE-2026-42334 in the mongoose package for Root:npm. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...