Quick answers
- Is CVE-2026-42334 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42334 being exploited in the wild.
- How severe is CVE-2026-42334?
- High severity, with a CVSS score of 7.5, published 14 May 2026.
- Which products and versions are affected?
- mongoose (npm) SEMVER:introduced=0,fixed=6.13.9.
- Is there a fix for CVE-2026-42334?
- Yes. mongoose (npm): upgrade to 6.13.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42334 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42334?
- Check whether you run mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mongoose (npm): upgrade to 6.13.9 or later
npm install mongoose@6.13.9
Technical details
A NoSQL injection vulnerability exists in Mongoose's 'sanitizeFilter' mechanism. While the feature is designed to wrap query operators in '$eq' to neutralize them, it failed to include the '$nor' logical operator in its recursive sanitization routine. Because '$nor' accepts an array and arrays do not trigger the internal 'hasDollarKeys()' check, an attacker can inject malicious operators like '$ne', '$gt', or '$regex' within a '$nor' clause. This bypass is effective when applications pass unsanitized user-controlled objects (e.g., 'req.body') directly into query methods. The issue is resolved in versions 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
Affected products
- Automattic Mongoose < 6.13.9, 7.0.0 - 7.8.8, 8.0.0 - 8.22.0, 9.0.0 - 9.1.5
Identifiers
- CVE-2026-42334
- GHSA-wpg9-53fq-2r8h
Timeline
- 2026-05-01: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD