Mongoose: Connection-level sanitizeFilter bypass (CVE-2026-125119)

Mongoose fails to apply the sanitizeFilter security option when configured at the connection level via mongoose.connect() or createConnection(). While the connection reports the option as enabled, internal query casting logic fails to reference the configuration, rendering it ineffective. Applications relying on this setting to mitigate query selector injection remain vulnerable to attacks where malicious operators, such as { $ne: null }, are passed into query filters. This issue affects Mongoose versions 6.x, 7.x, 8.x, and 9.x.

Impact

Attackers can bypass application-level authentication and data filtering by injecting MongoDB query operators into user-controlled input fields. For instance, passing an operator object as a password or username value can cause the database to return documents that should otherwise be restricted.

Recommendation

• Upgrade Mongoose to a patched version: v6.13.12, v7.8.13, v8.24.7, or v9.11.4.
• Until patching is possible, shift from connection-level configuration to global or query-level sanitization:
• Use global settings: mongoose.set('sanitizeFilter', true).
• Use query-level settings: Model.find().sanitizeFilter(true).
• Audit existing application logic for dependencies on connection-level security configurations.