Mongoose (>= 8.0.0, < 8.24.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mongoose--8.0.0--8.24.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 01:52:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoose: countDocuments() sanitizeFilter bypass (CVE-2026-125120)https://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/Wed, 11 Nov 2026 01:52:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongoose-sanitizefilter-bypass/Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.Mongoose failed to apply the sanitizeFilter security utility to countDocuments() queries, which is designed to protect against query selector injection attacks. If an application passes unsanitized user-supplied input directly to the countDocuments() filter argument, an attacker may be able to inject malicious query selectors. This vulnerability is identified as CVE-2026-125120.

Impact

Successful exploitation may allow an attacker to alter the query logic of database operations, potentially resulting in unauthorized data exposure or information disclosure depending on how the application handles the query results.

Recommendation

Upgrade Mongoose to the following versions or later to ensure sanitizeFilter is applied correctly to countDocuments() queries:

  • Upgrade to version ^9.9.2
  • Upgrade to version ^8.24.3
  • Upgrade to version ^7.8.12
  • Upgrade to version ^6.13.11

If immediate upgrading is not possible, implement the provided middleware to enforce filtering on countDocuments calls as a temporary mitigation.

]]>criticaladvisory