CVE-2026-125116

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.12 Mongoose versions prior to 7.8.13 Mongoose versions prior to 8.24.7 Mongoose versions prior to 9.11.4

Description Mongoose uses attacker-controlled discriminator key values, including the default t field, to index plain-object registries like Model.discriminators and schema.discriminators without verifying if the property belongs to the object itself. This allows values such as constructor, toString, or hasOwnProperty to resolve to inherited built-in functions rather than a registered discriminator. This leads to type confusion during model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. Additionally, in the bulkWrite() insertOne path when skipValidation is enabled, using a constructor value can result in a raw input object being stored without schema casting or strict filtering. A poisoned document stored in this manner can cause all subsequent queries that hydrate it to fail until the document is deleted.

Recommendations Update to version 6.13.12 or later. Update to version 7.8.13 or later. Update to version 8.24.7 or later. Update to version 9.11.4 or later.