Mongoose Security Flaws Led by CVE-2026-125120 (CVSS 9.8) Impact 4.8 Million Weekly Users

TL;DR

Maintainers of the Mongoose MongoDB tool patched five critical and high-risk Mongoose security flaws across all supported branches. Led by CVE-2026-125120 (CVSS 9.8) and CVE-2026-125117 (CVSS 8.2), the bugs allow query injection, app crashes, and prototype pollution. Devs must update to the latest builds right away to protect their Node.js apps.

Notable CVEs

Why It Matters

Mongoose is the top MongoDB data modeling tool for Node.js apps. According to npm stats, devs pull the package over 4.8 million times per week across 20,700 projects. Therefore, these Mongoose security flaws put a huge number of web servers at risk.

Currently, no active attacks in the wild have been confirmed for any of the five flaws. However, the public GitHub reports include working proof-of-concept code for four of the bugs (CVE-2026-125116 to CVE-2026-125119). Researchers koyokr, Linus-Shyu, and Fcmam5 reported the bugs to the team.

How the Attack Works

Filter Sanitization Bypasses

First, two bugs break the sanitizeFilter setting that blocks NoSQL query injection. In CVE-2026-125120 (CVSS 9.8), the tool fails to run sanitizeFilter during countDocuments() calls. Similarly, CVE-2026-125119 (CVSS 7.5) happens because createClient() moves the connection sanitizeFilter option into Connection.config, which queries never check. As a result, an attacker can pass objects like $ne to skip password checks or leak user data.

Inherited Property Overwrites and Prototype Pollution

Second, CVE-2026-125117 (CVSS 8.2) lets attacker keys overwrite inherited methods during document loads, path updates, and merges. For instance, a key naming toString.call overwrites the shared function and crashes every later query in the app. Third, CVE-2026-125118 (CVSS 6.5) allows prototype pollution in Schema.prototype.virtual() because it lacked checks for __proto__ and constructor keys. Finally, CVE-2026-125116 (CVSS 4.8) lets discriminator keys like constructor skip schema checks during bulk writes and poison database tables.

Affected Versions

These five Mongoose security flaws hit versions before 6.13.12, 7.0.0 to 7.8.12, 8.0.0 to 8.24.6, and 9.0.0 to 9.11.3. Specifically, CVE-2026-125120 affects builds before 6.13.11, 7.8.12, 8.24.3, and 9.9.2.

Patch and Mitigation Steps

Devs should update Mongoose to versions 9.11.4, 8.24.7, 7.8.13, or 6.13.12 right away to fix all five bugs. If teams cannot patch now, they can add a pre-countDocuments hook that runs mongoose.sanitizeFilter() on each filter. In addition, devs should turn on sanitizeFilter globally via mongoose.set() instead of on the connection. Taking these steps will keep your database safe.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.