Is CVE-2026-125118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125118 being exploited in the wild.

How severe is CVE-2026-125118?

Medium severity, with a CVSS score of 6.5, published 9 November 2026.

Which products and versions are affected?

Mongoose all maintained release lines; mongoose (npm) < 6.13.12, SEMVER:introduced=0,fixed=6.13.12.

Is there a fix for CVE-2026-125118?

Yes. mongoose (npm): upgrade to 6.13.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125118 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125118?

Check whether you run Mongoose or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125118: Mongoose prototype pollution in Schema.prototype.virtual()

Q: Is there a fix for CVE-2026-125118?

Yes. mongoose (npm): upgrade to 6.13.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125118 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-125118?

Check whether you run Mongoose or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125118 · Severity: medium · CVSS 6.5 · Published 2026-11-09

Mongoose, a popular Node.js library for MongoDB database access, contains a prototype pollution vulnerability in its schema virtual field feature. An attacker who can control schema field names—such as in a CMS with user-generated forms or dynamic schema builders—can inject malicious code into JavaScript's base objects, leading to authentication bypass, privilege escalation, or arbitrary code execution on the server.

Technologies: mongoose (npm). Vendors: npm.

Quick answers

Is CVE-2026-125118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125118 being exploited in the wild.
How severe is CVE-2026-125118?: Medium severity, with a CVSS score of 6.5, published 9 November 2026.
Which products and versions are affected?: Mongoose all maintained release lines; mongoose (npm) < 6.13.12, SEMVER:introduced=0,fixed=6.13.12.
Is there a fix for CVE-2026-125118?: Yes. mongoose (npm): upgrade to 6.13.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125118 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125118?: Check whether you run Mongoose or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mongoose (npm): upgrade to 6.13.12 or later
```
npm install mongoose@6.13.12
```

Technical details

The vulnerability exists in Schema.prototype.virtual() which lacks the specialProperties validation checks (for __proto__, constructor, prototype) that were added in CVE-2022-2564/CVE-2022-24304 to fix the same class of bug in path()/add() methods. By calling virtual() with a path containing __proto__, constructor, or prototype segments, an attacker can write arbitrary properties onto Object.prototype or Function.prototype, enabling object property spoofing and Function.prototype gadget chain exploitation.

Affected products

Mongoose Mongoose all maintained release lines

Identifiers

CVE-2026-125118
GHSA-6972-9mcm-vhwj

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.