Injection Flaw in Mongoose Affects Document Counting Functionality
CVE-2026-125120
9.8CRITICAL
What is CVE-2026-125120?
Prior to versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2, the Mongoose library inadequately applied its sanitizeFilter query selector injection defense in the countDocuments() method. This flaw allows attackers to pass manipulated filter values that could enable unintended query operator interpretations, thereby including documents in counts that should not be matched. This can compromise authorization checks and application logic reliant on accurate document count results. The vulnerability has been addressed in the specified versions.
Affected Version(s)
mongoose < 6.13.11 < 6.13.11
mongoose >= 7.0.0, < 7.8.12 < 7.0.0, 7.8.12
mongoose >= 8.0.0, < 8.24.3 < 8.0.0, 8.24.3