# CVE-2019-17426: Automattic Mongoose improper input validation in query filter

Source: https://junglewise.ai/threats/cve-2019-17426-automattic-mongoose-improper-input-validation-in-query-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-10-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-17426 · Severity: low · CVSS 3.1 · Published 2019-10-22

Mongoose is a popular Node.js library for interacting with MongoDB databases. A flaw in input validation allows attackers to bypass query filters by injecting a special "_bsontype" attribute into query objects, potentially letting them access unauthorized data or bypass authentication checks. Applications using Mongoose with unsanitized user input are at risk of data theft and account takeover.

Technologies: [mongoose (npm)](https://junglewise.ai/threats/technologies/mongoose). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-17426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-17426 being exploited in the wild.

**How severe is CVE-2019-17426?** Low severity, with a CVSS score of 3.1, published 22 October 2019.

**Which products and versions are affected?** mongoose (npm) SEMVER:introduced=5.0.0,fixed=5.7.5.

**Is there a fix for CVE-2019-17426?** Yes. mongoose (npm): upgrade to 5.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-17426 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-17426?** Check whether you run mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongoose (npm): upgrade to 5.7.5 or later

  ```sh
  npm install mongoose@5.7.5
  ```


## Technical details

Mongoose fails to sanitize query objects containing the "_bsontype" attribute, a reserved field used internally by the BSON parser. When a query object with this attribute is passed to methods like findOne() or find(), Mongoose ignores the entire query condition, resulting in a null or wildcard filter. This is a CWE-20 (Improper Input Validation) vulnerability. The attack requires network access to a Mongoose-using application and no authentication; the attacker simply crafts a JSON payload with "_bsontype" and submits it as a query parameter. An attacker can bypass access controls, steal sensitive data, or assume other users' identities. The vulnerability was fixed in Mongoose 4.13.21 and 5.7.5 by filtering the "_bsontype" attribute before querying MongoDB.

## Affected products

- Automattic Mongoose 5.0.0 through 5.7.4, and all versions prior to 4.13.21

## Identifiers

- CVE-2019-17426
- GHSA-8687-vv9j-hgph

## Timeline

- 2019-10-10: disclosed
- 2019-10-22: patched: Mongoose 4.13.21 and 5.7.5 released

## References

- [https://github.com/Automattic/mongoose/issues/8222](https://github.com/Automattic/mongoose/issues/8222)

## Related threats

- [Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments)
- [Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied)
- [Mongoose prototype pollution in Schema.prototype.virtual()](https://junglewise.ai/threats/cve-2026-125118-mongoose-prototype-pollution-via-schema-prototype-virtual)
- [Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in)
- [Mongoose discriminator key inheritance bypass](https://junglewise.ai/threats/cve-2026-125116-mongoose-discriminator-key-values-matching-inherited-properties)