Executive brief
Mongoose, a popular tool for managing MongoDB databases in Node.js applications, is vulnerable to a flaw that allows attackers to modify the behavior of the underlying application. By sending specially crafted data to an update command, an attacker can inject properties into the global object prototype, potentially leading to application instability or unauthorized data modification. This could impact any application that passes user-provided data directly into Mongoose update functions without prior validation.
Technical details
A prototype pollution vulnerability exists in Mongoose's update casting logic. When an application passes a user-controlled object to update methods (such as updateOne) that contains a dotted path prefixed with '__proto__', Mongoose fails to properly sanitize the path during the casting process. This allows an attacker to set internal properties like '$fullPath' and '$parentSchemaDocArray' on the global Object.prototype. The vulnerability is rooted in the Schema._getSchema/path getter component. Attackers can exploit this over the network without authentication if the application directly uses request bodies in update queries. Patches are available in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.
Affected products
- Automattic mongoose < 6.13.10, >= 7.0.0 < 7.8.10, >= 8.0.0 < 8.24.1, >= 9.0.0 < 9.7.2
Timeline
- 2026-07-20: disclosed
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched