Mongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)
Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.
CVE search metadata
CVE search record: CVE-2026-125120. Severity: critical. CVSS: 9.8. EPSS: 0.57%. KEV: no. Product: mongoose (< 6.13.11), mongoose (>= 7.0.0, < 7.8.12), mongoose (>= 8.0.0, < 8.24.3), mongoose (>= 9.0.0, < 9.9.2). Brief: Mongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/
Triage facts
Revision 1- Applicability
- mongoose (< 6.13.11), mongoose (>= 7.0.0, < 7.8.12) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 01:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
Mongoose failed to apply the sanitizeFilter security utility to countDocuments() queries, which is designed to protect against query selector injection attacks. If an application passes unsanitized user-supplied input directly to the countDocuments() filter argument, an attacker may be able to inject malicious query selectors. This vulnerability is identified as CVE-2026-125120.
Impact
Successful exploitation may allow an attacker to alter the query logic of database operations, potentially resulting in unauthorized data exposure or information disclosure depending on how the application handles the query results.
Recommendation
Upgrade Mongoose to the following versions or later to ensure sanitizeFilter is applied correctly to countDocuments() queries:
- Upgrade to version ^9.9.2
- Upgrade to version ^8.24.3
- Upgrade to version ^7.8.12
- Upgrade to version ^6.13.11
If immediate upgrading is not possible, implement the provided middleware to enforce filtering on countDocuments calls as a temporary mitigation.
Immediate actions
Patch mongoose to 6.13.11 or later
Threat Hunt
Identify applications using mongoose.countDocuments() with dynamic input parameters.
Data: Source code analysis, Application dependency inventory
Mitigations
Deploy the provided middleware to enforce sanitizeFilter on countDocuments.
CVE-2026-125120