Quick answers
- Is CVE-2026-125119 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125119 being exploited in the wild.
- How severe is CVE-2026-125119?
- High severity, with a CVSS score of 7.5, published 9 November 2026.
- Which products and versions are affected?
- Automattic Mongoose 6.0.0 through 9.11.2; mongoose (npm) >= 6.0.0, < 6.13.12, SEMVER:introduced=6.0.0,fixed=6.13.12.
- Is there a fix for CVE-2026-125119?
- Yes. mongoose (npm): upgrade to 6.13.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-125119 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-125119?
- Check whether you run Automattic Mongoose or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mongoose (npm): upgrade to 6.13.12 or later
npm install mongoose@6.13.12
Technical details
The sanitizeFilter option, introduced in Mongoose 6.0.0, is stored in Connection.config but Query#_castConditions() only checks Connection.options, causing the defense to be skipped despite Connection#get('sanitizeFilter') returning true. An attacker controlling filter input can inject operators like {$ne: null} to manipulate query logic, such as bypassing password checks via {password: {$ne: null}}. The vulnerability affects connection-level configuration but not global or per-query settings.
Affected products
- Automattic Mongoose 6.0.0 through 9.11.2
Identifiers
- CVE-2026-125119
- GHSA-gg4r-jv3p-qx3c
Timeline
- 2026-11-10: disclosed