Query Sanitization Bypass in Mongoose by Automattic

CVE-2026-42334

What is CVE-2026-42334?

A flaw in Mongoose, an object modeling tool for MongoDB, allows malicious actors to bypass the query sanitization mechanism when using the $nor operator. In Mongoose versions prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, while the sanitizeFilter feature aims to neutralize query operators by wrapping them in $eq, the $nor operator was left unsanitized. This oversight enables attackers to inject harmful MongoDB operators like $ne, $gt, or $regex within a $nor clause without proper sanitization, posing serious security risks to applications utilizing the affected Mongoose versions.

References