MO
Product
Mongoose
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 1Medium 0Low 0
Watch
Add Mongoose to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-23061 | 9.8 | Jan 15 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection Affected: 6.0.0 before 6.13.6; 7.0.0 before 7.8.4; 8.0.0 before 8.9.5 |
| CVE-2023-3696 | 9.8 | Jul 17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4 Affected: before 5.13.20; 6.0.0 before 6.11.3; 7.0.0 before 7.3.4 |
| CVE-2022-2564 | 9.8 | Jul 28 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6 Affected: before 5.13.15; 6.0.0 before 6.4.6 |
| CVE-2024-53900 | 9.1 | Dec 2 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection Affected: before 6.13.5; 7.0.1 before 7.8.3; 8.0.1 before 8.8.3; 7.0.0; 8.0.0 |
| CVE-2019-17426 | 9.1 | Oct 10 | Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored Affected: through 5.7.4 |
| CVE-2026-42334 | 7.5 | May 14 | Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection Affected: before 6.13.9; 7.0.0 before 7.8.9; 8.0.0 before 8.22.1; 9.0.0 before 9.1.6 |
Showing 6