# CVE-2026-125118: Mongoose prototype pollution in Schema.prototype.virtual()

Source: https://junglewise.ai/threats/cve-2026-125118-mongoose-prototype-pollution-via-schema-prototype-virtual  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125118 · Severity: medium · CVSS 6.5 · Published 2026-11-09

Mongoose, a popular Node.js library for MongoDB database access, contains a prototype pollution vulnerability in its schema virtual field feature. An attacker who can control schema field names—such as in a CMS with user-generated forms or dynamic schema builders—can inject malicious code into JavaScript's base objects, leading to authentication bypass, privilege escalation, or arbitrary code execution on the server.

Technologies: [mongoose (npm)](https://junglewise.ai/threats/technologies/mongoose). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-125118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125118 being exploited in the wild.

**How severe is CVE-2026-125118?** Medium severity, with a CVSS score of 6.5, published 9 November 2026.

**Which products and versions are affected?** Mongoose all maintained release lines; mongoose (npm) < 6.13.12, SEMVER:introduced=0,fixed=6.13.12.

**Is there a fix for CVE-2026-125118?** Yes. mongoose (npm): upgrade to 6.13.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125118 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125118?** Check whether you run Mongoose or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongoose (npm): upgrade to 6.13.12 or later

  ```sh
  npm install mongoose@6.13.12
  ```


## Technical details

The vulnerability exists in Schema.prototype.virtual() which lacks the specialProperties validation checks (for __proto__, constructor, prototype) that were added in CVE-2022-2564/CVE-2022-24304 to fix the same class of bug in path()/add() methods. By calling virtual() with a path containing __proto__, constructor, or prototype segments, an attacker can write arbitrary properties onto Object.prototype or Function.prototype, enabling object property spoofing and Function.prototype gadget chain exploitation.

## Affected products

- Mongoose Mongoose all maintained release lines

## Identifiers

- CVE-2026-125118
- GHSA-6972-9mcm-vhwj

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments)
- [Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied)
- [Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in)
- [Mongoose discriminator key inheritance bypass](https://junglewise.ai/threats/cve-2026-125116-mongoose-discriminator-key-values-matching-inherited-properties)
- [Mongoose prototype pollution via __proto__ in update casting](https://junglewise.ai/threats/cve-2026-73562-mongoose-prototype-pollution-via-proto-in-update-casting)