CVE-2026-125119

Name of the Vulnerable Software and Affected Versions Mongoose versions 6.0.0 through 6.13.11 Mongoose versions 7.x through 7.8.12 Mongoose versions 8.x through 8.24.6 Mongoose versions 9.x through 9.11.3

Description Mongoose fails to correctly apply the connection-level sanitizeFilter option when configured via mongoose.connect() or createConnection(). While the connection reports the defense as enabled, the Query.prototype. castConditions() function and query casting mechanisms do not read this specific configuration. This allows an attacker to pass a crafted object containing query operators into a query filter, potentially bypassing authentication by matching account records without a literal password. Global configuration via mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() are not affected.

Recommendations Update to version 6.13.12. Update to version 7.8.13. Update to version 8.24.7. Update to version 9.11.4.