Product
Mongoose versions prior to the patches failed to apply the sanitizeFilter utility to countDocuments() queries, allowing potential NoSQL injection when user input is passed directly to the filter argument.