Document Inheritance Vulnerability in Mongoose by Automattic
CVE-2026-125117
What is CVE-2026-125117?
A vulnerability in Mongoose, the popular MongoDB object modeling tool by Automattic, can lead to unintended overwrites of built-in shared functions due to improper handling of inherited document properties. This occurs when attacker-controlled keys are used, allowing for malicious alterations that can affect unrelated queries and models. The risk is amplified when strict mode is disabled for documents, permitting descent through object prototypes that can compromise schema options and validators. Mongoose has addressed this issue in recent updates, so all users are advised to upgrade to the latest versions to safeguard their applications.
Affected Version(s)
mongoose < 6.13.12 < 6.13.12
mongoose >= 7.0.0, < 7.8.13 < 7.0.0, 7.8.13
mongoose >= 8.0.0, < 8.24.7 < 8.0.0, 8.24.7