CVE-2026-73562

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.10 Mongoose versions prior to 7.8.10 Mongoose versions prior to 8.24.1 Mongoose versions prior to 9.7.2

Description Passing user-controlled updates to functions like updateOne(filter, req.body) can lead to prototype pollution. This occurs when a proto .x dotted path is used under the $set operator. The Schema.prototype.path and Schema.prototype. getPathType functions may treat inherited properties of schema.paths and schema.nested as schema types. This allows the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype, making these properties visible on newly created objects and potentially impacting application integrity and availability.

Recommendations Update to version 6.13.10 or later. Update to version 7.8.10 or later. Update to version 8.24.1 or later. Update to version 9.7.2 or later.