MongoDB Object Modeling Tool Vulnerability in Mongoose
CVE-2026-125119
What is CVE-2026-125119?
The Mongoose library, widely used for MongoDB object modeling, has a vulnerability that stems from improper handling of the sanitizeFilter option. Affected versions store the sanitizeFilter option in Connection.config but do not validate this setting during query casting. As a result, when applications utilize sanitizeFilter without correctly applying it to filter queries, they risk allowing attackers to bypass authentication checks by crafting malicious query operators. This flaw particularly impacts applications that mistakenly trust the sanitizeFilter configuration while failing to sanitize the query selector objects themselves. It's important to upgrade to the patched versions to mitigate these risks.
Affected Version(s)
mongoose >= 6.0.0, < 6.13.12 < 6.0.0, 6.13.12
mongoose >= 7.0.0, < 7.8.13 < 7.0.0, 7.8.13
mongoose >= 8.0.0, < 8.24.7 < 8.0.0, 8.24.7