GHSA-pcrw-h46h-c93h

Source

https://github.com/advisories/GHSA-pcrw-h46h-c93h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pcrw-h46h-c93h

Aliases

CVE-2026-125120

Published

2026-11-10T19:37:32Z

Modified

2026-11-10T19:45:09Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Mongoose: sanitizeFilter not applied on countDocuments

Details

Impact

sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries.

Patches

Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.

^9.9.2
^8.24.3
^7.8.12
^6.13.11

Workarounds

Middleware:

mongoose.plugin(function() {
  schema.pre('countDocuments', function() {
    // This will always apply `sanitizeFilter` on `countDocuments`
    mongoose.sanitizeFilter(this.getFilter());
  });
});

Database specific

{
    "cwe_ids": [
        "CWE-943"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T19:37:32Z",
    "nvd_published_at": "2026-11-09T23:17:22Z",
    "severity": "CRITICAL"
}

References

Affected packages

npm / mongoose

Package

Name: mongoose; View open source insights on deps.dev
Purl: pkg:npm/mongoose

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.13.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"

npm / mongoose

Package

Name: mongoose; View open source insights on deps.dev
Purl: pkg:npm/mongoose

Affected ranges

Type: SEMVER
Events: Introduced

7.0.0

Fixed

7.8.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"

npm / mongoose

Package

Name: mongoose; View open source insights on deps.dev
Purl: pkg:npm/mongoose

Affected ranges

Type: SEMVER
Events: Introduced

8.0.0

Fixed

8.24.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"

npm / mongoose

Package

Name: mongoose; View open source insights on deps.dev
Purl: pkg:npm/mongoose

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"