CVE-2026-125120

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.11 Mongoose versions prior to 7.8.12 Mongoose versions prior to 8.24.3 Mongoose versions prior to 9.9.2

Description Mongoose is a MongoDB object modeling tool for asynchronous environments. The countDocuments() function fails to apply the configured sanitizeFilter defense against query selector injection. This allows a remote, unauthenticated attacker to pass query operator objects as filter values, which are processed as operators instead of literal values. Consequently, the resulting count may include documents that should not match, potentially undermining application logic or authorization mechanisms.

Recommendations Update to version 6.13.11 or later. Update to version 7.8.12 or later. Update to version 8.24.3 or later. Update to version 9.9.2 or later.