Cpe:2.3:a:mongoose:mongoose:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amongoosemongoose/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 02:05:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoose: Connection-level sanitizeFilter bypass (CVE-2026-125119)https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/Wed, 11 Nov 2026 02:05:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter/A bug in Mongoose allows MongoDB query selector injection due to the failure of connection-level sanitizeFilter configurations to apply, potentially enabling unauthorized record access.Mongoose fails to apply the sanitizeFilter security option when configured at the connection level via mongoose.connect() or createConnection(). While the connection reports the option as enabled, internal query casting logic fails to reference the configuration, rendering it ineffective. Applications relying on this setting to mitigate query selector injection remain vulnerable to attacks where malicious operators, such as { $ne: null }, are passed into query filters. This issue affects Mongoose versions 6.x, 7.x, 8.x, and 9.x.

Impact

Attackers can bypass application-level authentication and data filtering by injecting MongoDB query operators into user-controlled input fields. For instance, passing an operator object as a password or username value can cause the database to return documents that should otherwise be restricted.

Recommendation

  • Upgrade Mongoose to a patched version: v6.13.12, v7.8.13, v8.24.7, or v9.11.4.
  • Until patching is possible, shift from connection-level configuration to global or query-level sanitization:
  • Use global settings: mongoose.set('sanitizeFilter', true).
  • Use query-level settings: Model.find().sanitizeFilter(true).
  • Audit existing application logic for dependencies on connection-level security configurations.
]]>highadvisoryweb-applicationdatabase-securityinjectionmongoosemongodbMongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/Wed, 11 Nov 2026 01:52:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.Mongoose failed to apply the sanitizeFilter security utility to countDocuments() queries, which is designed to protect against query selector injection attacks. If an application passes unsanitized user-supplied input directly to the countDocuments() filter argument, an attacker may be able to inject malicious query selectors. This vulnerability is identified as CVE-2026-125120.

Impact

Successful exploitation may allow an attacker to alter the query logic of database operations, potentially resulting in unauthorized data exposure or information disclosure depending on how the application handles the query results.

Recommendation

Upgrade Mongoose to the following versions or later to ensure sanitizeFilter is applied correctly to countDocuments() queries:

  • Upgrade to version ^9.9.2
  • Upgrade to version ^8.24.3
  • Upgrade to version ^7.8.12
  • Upgrade to version ^6.13.11

If immediate upgrading is not possible, implement the provided middleware to enforce filtering on countDocuments calls as a temporary mitigation.

]]>criticaladvisory