Executive brief
Mongoose is a popular Node.js library for working with MongoDB databases. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript's Object.prototype by passing specially crafted update objects to Mongoose queries like updateOne(). This can lead to data integrity issues and potential application malfunction across the entire process.
Technical details
The vulnerability is a prototype pollution (CWE-1321) in Mongoose's update casting logic. When processing user-controlled updates containing __proto__-prefixed dotted paths (e.g., "__proto__.x"), the Schema._getSchema/path getter fails to properly sanitize the input, causing Mongoose to set properties like $fullPath and $parentSchemaDocArray directly on Object.prototype. Attack vector is network-based with no authentication or user interaction required; any application accepting user input in update operations (e.g., MyModel.updateOne(filter, req.body)) is vulnerable. The pollution persists across the application runtime, affecting all subsequently created objects. Patches are available in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.
Affected products
- Automattic Mongoose <6.13.10, 7.0.0-7.8.9, 8.0.0-8.24.0, 9.0.0-9.7.1
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Patches released: 6.13.10, 7.8.10, 8.24.1, 9.7.2