Prototype Pollution in Mongoose ORM Versions by Automattic
CVE-2026-125118
6.5MEDIUM
What is CVE-2026-125118?
Mongoose, a popular MongoDB object modeling tool, has a vulnerability that allows attackers to exploit unvalidated virtual field names in dynamic schemas. By manipulating path segments like proto, constructor, or prototype, attackers can induce prototype pollution, affecting inherited property checks and potentially leading to unauthorized actions. This vulnerability is resolved in recent Mongoose versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Affected Version(s)
mongoose < 6.13.12 < 6.13.12
mongoose >= 7.0.0, < 7.8.13 < 7.0.0, 7.8.13
mongoose >= 8.0.0, < 8.24.7 < 8.0.0, 8.24.7