EUVD-2026-120502

Mongoose: Connection-level sanitizeFilter not applied...

GHSA-PCRW-H46H-C93H Mongoose: sanitizeFilter not applied on countDocuments

Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...

Mongoose: sanitizeFilter not applied on countDocuments

Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments queries. Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the...

EUVD-2026-120503

Mongoose: sanitizeFilter not applied on countDocuments...

CVE-2026-125119

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions and query casting check other optio...

CVE-2026-125119 Mongoose: Connection-level sanitizeFilter not applied

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions and query casting check other optio...

CVE-2026-125119

The Mongoose MongoDB object modeling tool is vulnerable to a security bypass because it fails to correctly read the connection-level sanitizeFilter option. From versions 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, the tool stores this option in Connection.config, but the query casting logic ...

PT-2026-141175

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.11 Mongoose versions prior to 7.8.12 Mongoose versions prior to 8.24.3 Mongoose versions prior to 9.9.2 Description Mongoose is a MongoDB object modeling tool for asynchronous environments. The countDocuments...

CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions and query casting check other optio...