CVE-2026-125117

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init, setting dotted paths in $set, and merging update documents in...

EUVD-2026-120498

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init, setting dotted paths in $set, and merging update documents in...

CVE-2026-125117 Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init, setting dotted paths in $set, and merging update documents in...

CVE-2026-125117

The Mongoose MongoDB object modeling tool (prior to versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4 ) is vulnerable to a prototype pollution-style issue where it can descend into inherited properties during database document loading in init(), setting dotted paths in $__set, and merging update docum...