Start for Free
npm

mongoose

View on npm registry
14 Total advisories
14 Vulnerabilities
0 Malware

Dependency scanning

Check whether mongoose is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 4.8
npm

CVE-2026-125116

Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
MEDIUM 6.5
npm

CVE-2026-125118

Mongoose: Prototype pollution via Schema.prototype.virtual()
HIGH 8.2
npm

CVE-2026-125117

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
HIGH 7.5
npm

CVE-2026-125119

Mongoose: Connection-level sanitizeFilter not applied
CRITICAL 9.8
npm

CVE-2026-125120

Mongoose: sanitizeFilter not applied on countDocuments
MEDIUM 6.5
npm

CVE-2026-73562

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
HIGH 7.5
npm

CVE-2026-42334

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
CRITICAL 9.8
npm

CVE-2024-53900

Mongoose search injection vulnerability
CRITICAL 9.0
npm

CVE-2025-23061

Mongoose search injection vulnerability
CRITICAL 9.8
npm

CVE-2022-24304

Mongoose Vulnerable to Prototype Pollution in Schema Object
MEDIUM 5.1
npm

GHSA-r5xw-q988-826m

Remote Memory Exposure in mongoose
CRITICAL 10.0
npm

CVE-2023-3696

Mongoose Prototype Pollution vulnerability
HIGH 7.0
npm

CVE-2022-2564

automattic/mongoose vulnerable to Prototype pollution via Schema.path
CRITICAL 9.1
npm

CVE-2019-17426

Improper Input Validation in Automattic Mongoose

Browse more npm advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes