Mongoose fixes five flaws, including a critical sanitizeFilter gap: am I affected?

Am I affected: if your app uses the mongoose npm package in any of these affected ranges: < 6.13.12, >= 7.0.0, < 7.8.13, >= 8.0.0, < 8.24.7, or >= 9.0.0, < 9.11.4. The critical and first high-severity flaws matter most if you rely on sanitizeFilter to block query selector injection.

Do now: upgrade Mongoose to 9.11.4, 8.24.7, 7.8.13, or 6.13.12 or later for your major version and redeploy.

What the advisories say

CVE-2026-125120 (GHSA-pcrw-h46h-c93h), rated critical. sanitizeFilter is Mongoose's mechanism for protecting against query selector injection. The advisory says older versions did not apply it to countDocuments() queries. Affected: < 6.13.11, >= 7.0.0, < 7.8.12, >= 8.0.0, < 8.24.3, and >= 9.0.0, < 9.9.2. Fixed in 6.13.11, 7.8.12, 8.24.3, and 9.9.2, respectively. The advisory gives a workaround: a plugin with pre('countDocuments') middleware that applies mongoose.sanitizeFilter to the query's filter.

CVE-2026-125119 (GHSA-gg4r-jv3p-qx3c), rated high. When sanitizeFilter is set on a connection with mongoose.connect() or createConnection(uri, { sanitizeFilter: true }), the advisory says the connection reports it as enabled but queries never apply it. An app that relies on that option and passes an attacker-controlled object into a filter stays open to selector injection. Apps that set it globally with mongoose.set('sanitizeFilter') or per query with .sanitizeFilter() are not affected. Affected: >= 6.0.0, < 6.13.12, >= 7.0.0, < 7.8.13, >= 8.0.0, < 8.24.7, and >= 9.0.0, < 9.11.4. Fixed in 6.13.12, 7.8.13, 8.24.7, and 9.11.4, respectively.

CVE-2026-125117 (GHSA-8332-j7wj-wjw4), rated high. The advisory says Mongoose copied data into objects by property name without checking for inherited properties when loading documents, setting dotted paths and merging updates. A key such as toString can overwrite Object.prototype.toString.call, after which every later query in the process fails until it restarts. Ways in it lists: new Model(req.body) on a schema with a Mixed path, findOneAndReplace() with an untrusted replacement, or reading one stored document that contains such a field. lean() queries are not affected by the document-loading path. Affected: < 6.13.12, >= 7.0.0, < 7.8.13, >= 8.0.0, < 8.24.7, and >= 9.0.0, < 9.11.4. Fixed in 6.13.12, 7.8.13, 8.24.7, and 9.11.4, respectively.

CVE-2026-125116 (GHSA-wr5m-5jph-8m96), rated medium. A discriminator key value (__t by default) that names an inherited property, such as constructor, can crash the request. Through bulkWrite() insertOne with skipValidation: true and untrusted documents, it can store a raw object without schema casting or strict filtering, after which every query that returns that document fails until it is deleted. Same affected and fixed versions as CVE-2026-125117.

CVE-2026-125118 (GHSA-6972-9mcm-vhwj), rated medium. Schema.prototype.virtual() never got the protection added for earlier prototype pollution bugs, so a virtual path containing __proto__, constructor or prototype writes onto Object.prototype. The advisory says this matters when attackers can influence schema field names, such as dynamic schemas or form builders. Same affected and fixed versions as CVE-2026-125117.

The advisories list no fixed release for Mongoose 5.x or older.

What to do

Upgrading to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 or later, for your major version, covers all five advisories. Our advice beyond the upgrade: treat sanitizeFilter as a second layer, not the only one. Check that login and search inputs are strings before they reach a query, and copy only the fields you expect from req.body instead of passing it whole into a model or update.