EN PT-BR
← Voltar ao feed
high

Mongoose patches five flaws led by CVE-2026-125120 (CVSS 9.8) enabling NoSQL injection and prototype pollution

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 23:31 · coletado há 1 hora

The maintainers of Mongoose, the MongoDB data-modeling library for Node.js, have patched five flaws across all supported branches, led by CVE-2026-125120 (CVSS 9.8). The bugs allow NoSQL query injection, application crashes and prototype pollution. Two of them bypass the sanitizeFilter protection: one in countDocuments() and one in the connection configuration path. The package is reportedly downloaded about 4.8 million times a week across 20,700 projects. No active exploitation has been confirmed, but public GitHub reports for four of the bugs (CVE-2026-125116 to CVE-2026-125119) reportedly include working proof-of-concept code. Urgency is rated high rather than critical because the sanitizeFilter bypasses only matter when the application enables sanitizeFilter and passes attacker-controlled filter values to these calls (vuldb.com).

Entenda a falha

A vulnerabilidade

Mongoose, the MongoDB data-modeling library for Node.js, has five flaws. The most severe is CVE-2026-125120 (CVSS 9.8): countDocuments() does not apply sanitizeFilter, so NoSQL operator objects such as $ne are processed and can skip password checks or leak data. CVE-2026-125117 (8.2) lets attacker keys overwrite inherited methods and crash later queries. CVE-2026-125119 (7.5) is a connection-level sanitizeFilter bypass. CVE-2026-125118 (6.5) is prototype pollution in Schema.prototype.virtual(). CVE-2026-125116 (4.8) lets discriminator keys skip schema checks in bulk writes. Affected: before 6.13.12, 7.0.0 to 7.8.12, 8.0.0 to 8.24.6, 9.0.0 to 9.11.3. Fixed in 9.11.4, 8.24.7, 7.8.13, 6.13.12. The sanitizeFilter bypasses matter only when the app enables sanitizeFilter and passes attacker-controlled filters.

Como funciona

An application with sanitizeFilter enabled normally strips query operators from user-supplied filters before they reach MongoDB. When countDocuments() is called, that sanitization step is not run, so an object like $ne in a filter value is treated as a real operator and the count matches documents it should not. For the connection-level bug, createClient() stores the sanitizeFilter option in Connection.config, which queries never consult, so the protection silently never applies. In the other bugs, attacker-controlled keys reach document loading, path updates, merges, Schema.prototype.virtual() or bulk writes, and are used as property names without filtering, so inherited methods or prototypes get overwritten.

Por que é vulnerável

The root causes are missing checks. countDocuments() was never wired to the sanitizeFilter defense, and createClient() places the option where the query path does not look. The prototype-related bugs come from not rejecting dangerous keys such as proto and constructor in Schema.prototype.virtual(), in discriminator handling during bulk writes, and in document load, path update and merge code. The articles do not say why these went unnoticed. The fixes add the missing sanitization and key checks across the supported branches.

Onde está

The articles name countDocuments(), createClient() and Connection.config, Schema.prototype.virtual(), and the document load, path update, merge and bulk write code paths; no file or commit is cited.

Como foi descoberta

According to SecurityOnline, researchers koyokr, Linus-Shyu and Fcmam5 reported the bugs to the Mongoose maintainers, who patched all supported branches. The articles do not say how the researchers found them or which researcher reported which CVE. The flaws became public through GitHub reports. No active exploitation in the wild has been confirmed.

PoC pública

SecurityOnline says the public GitHub reports include working proof-of-concept code for four of the bugs, CVE-2026-125116 to CVE-2026-125119. No PoC is reported for CVE-2026-125120. The articles give no direct link to it and no details of what it demonstrates. Since working code is public, patch soon, even though no attacks in the wild are confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 00:17.

Detalhes técnicos

  • CVE-2026-125120 (CVSS 9.8): the sanitizeFilter defense is not applied in countDocuments(), so query operator objects are processed as operators and the count can include documents that should not match (vuldb.com). The article adds that a payload such as $ne can skip password checks.
  • CVE-2026-125119 (CVSS 7.5): createClient() moves the connection-level sanitizeFilter option into Connection.config, a location queries never check.
  • CVE-2026-125117 (CVSS 8.2): attacker-supplied keys overwrite inherited methods during document loads, path updates and merges, which can break shared functions and crash later queries.
  • CVE-2026-125118 (CVSS 6.5): Schema.prototype.virtual() lacks checks for proto and constructor keys, enabling prototype pollution.
  • CVE-2026-125116 (CVSS 4.8): discriminator keys such as constructor skip schema checks during bulk writes.
  • Affected ranges, per the article: before 6.13.12, 7.0.0 to 7.8.12, 8.0.0 to 8.24.6 and 9.0.0 to 9.11.3. The CVSS scores and vectors come from the article; the GitHub Security Advisory was not retrieved to confirm them.

Remediação

  • Update Mongoose to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 to fix all five bugs (per the article). For CVE-2026-125120 alone, VulDB lists the fixed builds as 6.13.11, 7.8.12, 8.24.3 and 9.9.2 (vuldb.com).
  • If patching is not possible now, add a pre-countDocuments hook that runs mongoose.sanitizeFilter() on each filter, and enable sanitizeFilter globally with mongoose.set() instead of per connection (per the article).
  • The GitHub advisory, the releases page and the fixing pull request were not retrieved during this research, so no Fix Details section is included.

Linha do tempo

  1. securityonline.info ↗ · pub. 09/11/2026 23:31 · coletado 10/11 00:00 primeiro registro

    Mongoose patches five flaws led by CVE-2026-125120 (CVSS 9.8) enabling NoSQL injection and prototype pollution

    ler a análise desta fonte

    The maintainers of Mongoose, the MongoDB data-modeling library for Node.js, have patched five flaws across all supported branches, led by CVE-2026-125120 (CVSS 9.8). The bugs allow NoSQL query injection, application crashes and prototype pollution. Two of them bypass the sanitizeFilter protection: one in countDocuments() and one in the connection configuration path. The package is reportedly downloaded about 4.8 million times a week across 20,700 projects. No active exploitation has been confirmed, but public GitHub reports for four of the bugs (CVE-2026-125116 to CVE-2026-125119) reportedly include working proof-of-concept code. Urgency is rated high rather than critical because the sanitizeFilter bypasses only matter when the application enables sanitizeFilter and passes attacker-controlled filter values to these calls (vuldb.com).

    Technical Details

    • CVE-2026-125120 (CVSS 9.8): the sanitizeFilter defense is not applied in countDocuments(), so query operator objects are processed as operators and the count can include documents that should not match (vuldb.com). The article adds that a payload such as $ne can skip password checks.
    • CVE-2026-125119 (CVSS 7.5): createClient() moves the connection-level sanitizeFilter option into Connection.config, a location queries never check.
    • CVE-2026-125117 (CVSS 8.2): attacker-supplied keys overwrite inherited methods during document loads, path updates and merges, which can break shared functions and crash later queries.
    • CVE-2026-125118 (CVSS 6.5): Schema.prototype.virtual() lacks checks for proto and constructor keys, enabling prototype pollution.
    • CVE-2026-125116 (CVSS 4.8): discriminator keys such as constructor skip schema checks during bulk writes.
    • Affected ranges, per the article: before 6.13.12, 7.0.0 to 7.8.12, 8.0.0 to 8.24.6 and 9.0.0 to 9.11.3. The CVSS scores and vectors come from the article; the GitHub Security Advisory was not retrieved to confirm them.

    Remediation

    • Update Mongoose to 9.11.4, 8.24.7, 7.8.13 or 6.13.12 to fix all five bugs (per the article). For CVE-2026-125120 alone, VulDB lists the fixed builds as 6.13.11, 7.8.12, 8.24.3 and 9.9.2 (vuldb.com).
    • If patching is not possible now, add a pre-countDocuments hook that runs mongoose.sanitizeFilter() on each filter, and enable sanitizeFilter globally with mongoose.set() instead of per connection (per the article).
    • The GitHub advisory, the releases page and the fixing pull request were not retrieved during this research, so no Fix Details section is included.