Type Confusion in Mongoose MongoDB Object Modeling Tool
CVE-2026-125116
4.8MEDIUM
What is CVE-2026-125116?
The Mongoose MongoDB object modeling tool, prior to versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4, is susceptible to type confusion vulnerabilities due to the use of attacker-controlled discriminator key values. This allows attackers to manipulate model construction and document creation. Specifically, the default __t field enables malicious inputs to bypass schema validation, potentially leading to the storage of harmful documents that may cause failures during subsequent queries. The flaw leverages inherited properties which can result in unintentional behavior in data handling, impacting application security.
Affected Version(s)
mongoose < 6.13.12 < 6.13.12
mongoose >= 7.0.0, < 7.8.13 < 7.0.0, 7.8.13
mongoose >= 8.0.0, < 8.24.7 < 8.0.0, 8.24.7