Please follow the instructions on Tidelift's security page to report a security issue.
Repository navigation
Security: Automattic/mongoose
Security
SECURITY.md
-
Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsGHSA-wr5m-5jph-8m96 published
Nov 2, 2026 by vkarpov15Moderate -
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema stateGHSA-8332-j7wj-wjw4 published
Nov 2, 2026 by vkarpov15High -
Prototype pollution via Schema.prototype.virtual()GHSA-6972-9mcm-vhwj published
Nov 2, 2026 by vkarpov15Moderate -
Connection-level sanitizeFilter not appliedGHSA-gg4r-jv3p-qx3c published
Nov 2, 2026 by vkarpov15High -
sanitizeFilter not applied on countDocumentsGHSA-pcrw-h46h-c93h published
Nov 2, 2026 by vkarpov15Critical -
Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)GHSA-664h-wqgq-64gw published
Jul 20, 2026 by vkarpov15Moderate -
Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionGHSA-wpg9-53fq-2r8h published
May 1, 2026 by vkarpov15High
Learn more about advisories related to Automattic/mongoose in the GitHub Advisory Database