Prototype Pollution Vulnerability in Mongoose ORM by Automattic
CVE-2026-73562
6.5MEDIUM
What is CVE-2026-73562?
Mongoose, an object modeling tool for MongoDB, has a vulnerability that allows for prototype pollution through user-controlled updates. Specifically, versions prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2 are at risk when executing update commands, such as MyModel.updateOne(filter, req.body). This vulnerability enables unintended properties to be set on Object.prototype, potentially compromising application integrity and availability. It is crucial for developers using Mongoose to upgrade to the patched versions to mitigate this risk.
Affected Version(s)
mongoose < 6.13.10 < 6.13.10
mongoose >= 7.0.0, < 7.8.10 < 7.0.0, 7.8.10
mongoose >= 8.0.0, < 8.24.1 < 8.0.0, 8.24.1