MongoDB and Mongoose vulnerabilities and security advisories

The newest reviewed advisories for mongodb and mongoose on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when MongoDB and Mongoose has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 11 · 8 critical, high or exploited

mediumJul 24, 2026

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

mongoose < 6.13.10 · fixed in 6.13.10
mongoose >= 7.0.0, < 7.8.10 · fixed in 7.8.10
mongoose >= 8.0.0, < 8.24.1 · fixed in 8.24.1
mongoose >= 9.0.0, < 9.7.2 · fixed in 9.7.2

GHSA-664h-wqgq-64gwCVE-2026-73562

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-664h-wqgq-64gw (CVE-2026-73562), severity medium
What it is: Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Affected packages:
- mongoose: affected versions < 6.13.10. Fixed in 6.13.10.
- mongoose: affected versions >= 7.0.0, < 7.8.10. Fixed in 7.8.10.
- mongoose: affected versions >= 8.0.0, < 8.24.1. Fixed in 8.24.1.
- mongoose: affected versions >= 9.0.0, < 9.7.2. Fixed in 9.7.2.
Details: https://github.com/advisories/GHSA-664h-wqgq-64gw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 5, 2026

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

mongoose < 6.13.9 · fixed in 6.13.9
mongoose >= 7.0.0, <= 7.8.8 · fixed in 7.8.9
mongoose >= 8.0.0, <= 8.22.0 · fixed in 8.22.1
mongoose >= 9.0.0, <= 9.1.5 · fixed in 9.1.6

GHSA-wpg9-53fq-2r8hCVE-2026-42334

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-wpg9-53fq-2r8h (CVE-2026-42334), severity high
What it is: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Affected packages:
- mongoose: affected versions < 6.13.9. Fixed in 6.13.9.
- mongoose: affected versions >= 7.0.0, <= 7.8.8. Fixed in 7.8.9.
- mongoose: affected versions >= 8.0.0, <= 8.22.0. Fixed in 8.22.1.
- mongoose: affected versions >= 9.0.0, <= 9.1.5. Fixed in 9.1.6.
Details: https://github.com/advisories/GHSA-wpg9-53fq-2r8h

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalJan 15, 2025

Mongoose search injection vulnerability

mongoose >= 8.0.0-rc0, < 8.9.5 · fixed in 8.9.5
mongoose >= 7.0.0-rc0, < 7.8.4 · fixed in 7.8.4
mongoose < 6.13.6 · fixed in 6.13.6

GHSA-vg7j-7cwx-8wgwCVE-2025-23061

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vg7j-7cwx-8wgw (CVE-2025-23061), severity critical
What it is: Mongoose search injection vulnerability
Affected packages:
- mongoose: affected versions >= 8.0.0-rc0, < 8.9.5. Fixed in 8.9.5.
- mongoose: affected versions >= 7.0.0-rc0, < 7.8.4. Fixed in 7.8.4.
- mongoose: affected versions < 6.13.6. Fixed in 6.13.6.
Details: https://github.com/advisories/GHSA-vg7j-7cwx-8wgw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highDec 2, 2024

Mongoose search injection vulnerability

mongoose >= 8.0.0-rc0, < 8.8.3 · fixed in 8.8.3
mongoose >= 7.0.0-rc0, < 7.8.3 · fixed in 7.8.3
mongoose >= 6.0.0-rc0, < 6.13.5 · fixed in 6.13.5
mongoose >= 3.6.0-rc0, < 5.13.23 · fixed in 5.13.23

GHSA-m7xq-9374-9rvxCVE-2024-53900

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-m7xq-9374-9rvx (CVE-2024-53900), severity high
What it is: Mongoose search injection vulnerability
Affected packages:
- mongoose: affected versions >= 8.0.0-rc0, < 8.8.3. Fixed in 8.8.3.
- mongoose: affected versions >= 7.0.0-rc0, < 7.8.3. Fixed in 7.8.3.
- mongoose: affected versions >= 6.0.0-rc0, < 6.13.5. Fixed in 6.13.5.
- mongoose: affected versions >= 3.6.0-rc0, < 5.13.23. Fixed in 5.13.23.
Details: https://github.com/advisories/GHSA-m7xq-9374-9rvx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumAug 29, 2023

MongoDB Driver may publish events containing authentication-related data

mongodb >= 3.6.0, < 3.6.10 · fixed in 3.6.10
mongodb >= 4.0.0, < 4.17.0 · fixed in 4.17.0
mongodb >= 5.0.0, < 5.8.0 · fixed in 5.8.0

GHSA-vxvm-qww3-2fh7CVE-2021-32050

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vxvm-qww3-2fh7 (CVE-2021-32050), severity medium
What it is: MongoDB Driver may publish events containing authentication-related data
Affected packages:
- mongodb: affected versions >= 3.6.0, < 3.6.10. Fixed in 3.6.10.
- mongodb: affected versions >= 4.0.0, < 4.17.0. Fixed in 4.17.0.
- mongodb: affected versions >= 5.0.0, < 5.8.0. Fixed in 5.8.0.
Details: https://github.com/advisories/GHSA-vxvm-qww3-2fh7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalJul 17, 2023

Mongoose Prototype Pollution vulnerability

mongoose >= 7.0.0, < 7.3.3 · fixed in 7.3.3
mongoose >= 6.0.0, < 6.11.3 · fixed in 6.11.3
mongoose < 5.13.20 · fixed in 5.13.20

GHSA-9m93-w8w6-76hhCVE-2023-3696

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-9m93-w8w6-76hh (CVE-2023-3696), severity critical
What it is: Mongoose Prototype Pollution vulnerability
Affected packages:
- mongoose: affected versions >= 7.0.0, < 7.3.3. Fixed in 7.3.3.
- mongoose: affected versions >= 6.0.0, < 6.11.3. Fixed in 6.11.3.
- mongoose: affected versions < 5.13.20. Fixed in 5.13.20.
Details: https://github.com/advisories/GHSA-9m93-w8w6-76hh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalAug 27, 2022

Mongoose Vulnerable to Prototype Pollution in Schema Object

mongoose >= 6.0.0, < 6.4.6 · fixed in 6.4.6
mongoose < 5.13.15 · fixed in 5.13.15

GHSA-h8hf-x3f4-xwgpCVE-2022-24304

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-h8hf-x3f4-xwgp (CVE-2022-24304), severity critical
What it is: Mongoose Vulnerable to Prototype Pollution in Schema Object
Affected packages:
- mongoose: affected versions >= 6.0.0, < 6.4.6. Fixed in 6.4.6.
- mongoose: affected versions < 5.13.15. Fixed in 5.13.15.
Details: https://github.com/advisories/GHSA-h8hf-x3f4-xwgp

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 29, 2022

automattic/mongoose vulnerable to Prototype pollution via Schema.path

mongoose >= 6.0.0, < 6.4.6 · fixed in 6.4.6
mongoose < 5.13.15 · fixed in 5.13.15

GHSA-f825-f98c-gj3gCVE-2022-2564

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-f825-f98c-gj3g (CVE-2022-2564), severity high
What it is: automattic/mongoose vulnerable to Prototype pollution via Schema.path
Affected packages:
- mongoose: affected versions >= 6.0.0, < 6.4.6. Fixed in 6.4.6.
- mongoose: affected versions < 5.13.15. Fixed in 5.13.15.
Details: https://github.com/advisories/GHSA-f825-f98c-gj3g

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highSep 3, 2020

Denial of Service in mongodb

mongodb < 3.1.13 · fixed in 3.1.13

GHSA-mh5c-679w-hh4r

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mh5c-679w-hh4r, severity high
What it is: Denial of Service in mongodb
Affected packages:
- mongodb: affected versions < 3.1.13. Fixed in 3.1.13.
Details: https://github.com/advisories/GHSA-mh5c-679w-hh4r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumSep 1, 2020

Remote Memory Exposure in mongoose

mongoose >= 3.5.5, <= 3.8.38 · fixed in 3.8.39
mongoose >= 4.0.0, <= 4.3.5 · fixed in 4.3.6

GHSA-r5xw-q988-826m

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-r5xw-q988-826m, severity medium
What it is: Remote Memory Exposure in mongoose
Affected packages:
- mongoose: affected versions >= 3.5.5, <= 3.8.38. Fixed in 3.8.39.
- mongoose: affected versions >= 4.0.0, <= 4.3.5. Fixed in 4.3.6.
Details: https://github.com/advisories/GHSA-r5xw-q988-826m

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalOct 22, 2019

Improper Input Validation in Automattic Mongoose

mongoose >= 5.0.0, < 5.7.5 · fixed in 5.7.5
mongoose < 4.13.21 · fixed in 4.13.21

GHSA-8687-vv9j-hgphCVE-2019-17426

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-8687-vv9j-hgph (CVE-2019-17426), severity critical
What it is: Improper Input Validation in Automattic Mongoose
Affected packages:
- mongoose: affected versions >= 5.0.0, < 5.7.5. Fixed in 5.7.5.
- mongoose: affected versions < 4.13.21. Fixed in 4.13.21.
Details: https://github.com/advisories/GHSA-8687-vv9j-hgph

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping MongoDB and Mongoose patched

npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.