CriticalGHSA-pcrw-h46h-c93hCVE-2026-125120

Mongoose: sanitizeFilter not applied on countDocuments

Published 10 Nov 2026 · Updated 10 Nov 2026

Is your project on an affected mongoose?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Affected packages

mongoosenpm
Affected
<6.13.11
Fixed in
6.13.11
Update to the fixed version for your release line, for example:npm install mongoose@6.13.11
mongoosenpm
Affected
>=7.0.0 <7.8.12
Fixed in
7.8.12
Update to the fixed version for your release line, for example:npm install mongoose@7.8.12
mongoosenpm
Affected
>=8.0.0 <8.24.3
Fixed in
8.24.3
Update to the fixed version for your release line, for example:npm install mongoose@8.24.3
mongoosenpm
Affected
>=9.0.0 <9.9.2
Fixed in
9.9.2
Update to the fixed version for your release line, for example:npm install mongoose@9.9.2

Details

Impact

sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries.

Patches

Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.

1. ^9.9.2 2. ^8.24.3 3. ^7.8.12 4. ^6.13.11

Workarounds

Middleware:

mongoose.plugin(function() {
  schema.pre('countDocuments', function() {
    // This will always apply `sanitizeFilter` on `countDocuments`
    mongoose.sanitizeFilter(this.getFilter());
  });
});

Is GHSA-pcrw-h46h-c93h in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected mongoose, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

More advisories for mongoose

  • MediumCVE-2026-125116Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections · 10 Nov 2026
  • HighCVE-2026-125117Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state · 10 Nov 2026
  • MediumCVE-2026-125118Mongoose: Prototype pollution via Schema.prototype.virtual() · 10 Nov 2026
  • HighCVE-2026-125119Mongoose: Connection-level sanitizeFilter not applied · 10 Nov 2026
  • MediumCVE-2026-73562Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) · 24 Jul 2026
  • HighCVE-2026-42334Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection · 5 May 2026
All 14 advisories for mongoose

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.