Mongoosejs Mongoose
6 CVEs affecting Mongoosejs Mongoose. Latest disclosed: 2026-05-14. Critical: 5, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3696 | Critical | 9.8 | 2023-07-17 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. |
CVE-2022-2564 | Critical | 9.8 | 2022-07-28 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. |
CVE-2024-53900 | Critical | 9.1 | 2024-12-02 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. |
CVE-2019-17426 | Critical | 9.1 | 2019-10-10 | Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignor… |
CVE-2025-23061 | Critical | 9.0 | 2025-01-15 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an inc… |
CVE-2026-42334 | High | 7.5 | 2026-05-14 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows b… |