---
id: "CVE-2026-125117"
page: "https://infrastack.ai/live/CVE-2026-125117"
kind: "vulnerability"
aliases: ["CVE-2026-125117", "GHSA-8332-j7wj-wjw4"]
title: "Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongoose", "fixed": ["6.13.12"], "affected": "< 6.13.12", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["7.8.13"], "affected": ">= 7.0.0, < 7.8.13", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["8.24.7"], "affected": ">= 8.0.0, < 8.24.7", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["9.11.4"], "affected": ">= 9.0.0, < 9.11.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-1321", "express", "mongodb", "mongoose", "node.js", "package"]
not_affected_if: ["lean-queries-only", "managed-hosting-not-relevant", "no-untrusted-input"]
published_at: "2026-11-09T23:17:22+00:00"
first_seen_at: "2026-11-10T20:57:07+00:00"
updated_at: "2026-11-10T21:15:58+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8332-j7wj-wjw4", "first_seen_at": "2026-11-10T20:57:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125117", "first_seen_at": "2026-11-10T21:15:58+00:00"}]
exploit_sources: []
---

# Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Link for people: https://infrastack.ai/live/CVE-2026-125117 (this .md is for agents)

Mongoose copies data into inherited object properties such as toString when loading, setting and merging documents, so a crafted key can overwrite Object.prototype.toString.call. An attacker who controls input can crash every query in the process until restart, or change schema validators shared by all documents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mongoose affected < 6.13.12 fixed 6.13.12
- npm:mongoose affected >= 7.0.0, < 7.8.13 fixed 7.8.13
- npm:mongoose affected >= 8.0.0, < 8.24.7 fixed 8.24.7
- npm:mongoose affected >= 9.0.0, < 9.11.4 fixed 9.11.4

## How to check

- Check the installed version with `npm ls mongoose`, and see whether it is below `6.13.12`, `7.8.13`, `8.24.7` or `9.11.4` for its major line.
- Search the code for `new Model(req.body)`, `findOneAndReplace(`, and `doc.set(` called with user-supplied paths or values.
- Check schemas for `Mixed` paths and for subdocuments with `strict: false`.

## Fix

- `mongoose` `6.13.12` for the 6.x line
- `mongoose` `7.8.13` for the 7.x line
- `mongoose` `8.24.7` for the 8.x line
- `mongoose` `9.11.4` for the 9.x line

## Timeline

- 2026-11-10T20:57:07+00:00 ghsa https://github.com/advisories/GHSA-8332-j7wj-wjw4
- 2026-11-10T21:15:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125117

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/Automattic/mongoose/security-advisories/GHSA-8332-j7wj-wjw4
- [advisory] Maintainer's advisory: github.com https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/6.13.12
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/7.8.13
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/8.24.7
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/9.11.4

## From the sources

### Summary

Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherited from its prototype:

1. Loading a document from the database (`init()`, also used by `Model.hydrate()`)
2. Setting a dotted path on a document (`$__set`, used by `new Model(obj)`, `doc.set()` and `doc.$set()`)
3. Merging update documents (`utils.mergeClone`, used by `findOneAndReplace()`, chained update calls and `Query.prototype.merge()`)

When a key names an inherited property, such as `toString` or `valueOf`, or a document internal such as `$__schema`, Mongoose writes into the shared object behind that property. The data comes from the attacker.

- **Denial of service.** For example, `{ "toString": { "call": 1 } }` overwrites `Object.prototype.toString.call`. Mongoose and most other libraries rely on `Object.prototype.toString.call()`. After the overwrite, every later query in the process throws `TypeError: _toString.call is not a function` until the process restarts. This includes queries on unrelated models.
- **Changing shared schema state.** Through a subdocument with `strict: false`, a path such as `profile.$__schema.paths.email.validators` reaches the subdocument's schema, which every document shares. Setting it to `[]` removes the `required` validator for every document in the process.

Mongoose already blocked `__proto__`, `constructor` and `prototype`, so these bugs cannot add properties to `Object.prototype` itself. They can still overwrite methods and properties of shared built-in functions and of Mongoose's internal objects.

### Details

#### 1. Loading documents: `init()`

```js
if (!schemaType && utils.isPOJO(value)) {
  // assume nested object
  if (!doc[i]) { doc[i] = {}; ... }
  init(self, value, doc[i], opts, path + '.');
}
```

For a stored field named `toString`, `doc[i]` is the inherited `Object.prototype.toString`. It is truthy, so `init()` recurses into that function and copies the stored subfields onto it.

This runs for every document Mongoose loads: `find()`, `findOne()`, cursors, populated documents and `Model.hydrate()`. It runs whatever the `strict` setting, and it applies to top-level and nested paths alike. `lean()` queries are not affected.

A malicious document can get into the collection in several ways:
- through a model with `strict: false`, for example `new Model(req.body).save()`;
- through another application or the raw MongoDB driver;
- through any update that writes arbitrary keys.

#### 2. Setting dotted paths: `$__set`

When it walks a dotted path, `$__set` read `obj[parts[i]]` and descended into whatever it found. That included inherited functions, such as `Object.prototype.toString` on a plain object or `Document.prototype.toObject` on a subdocument. On subdocuments it also included non-function internals that are prototype getters, such as `$__schema`, `schema`, `$__middleware` and `$__schemaTypeOptions`. Those point at objects that every document of the model shares.

Attacker-controlled input reaches this path through:
- **A `Mixed` path on a default, strict schema:** `new Model({ "mixed.toString.call": 1 })`, or `doc.set({ "mixed.toString.call": 1 })`. Nothing needs to be saved.
- **Any root path on a schema with `strict: false`:** for example `doc.set('toString.call', 1)`.
- **A subdocument with `strict: false`**, when the application passes a user-controlled path to `doc.set(path, value)`: for example `doc.set('profile.$__schema.paths.email.validators', [])`.

#### 3. Merging updates: `utils.mergeClone`

```js
if (typeof to[key] === 'undefined') {
  to[key] = clone(fromObj[key]);
} else if (isObject(val)) {
  mergeClone(to[key], val);   // to[key] may be an inherited built-in
}
```

`to[key]` was read without an own-property check, so a key such as `toString` recursed into `Object.prototype.toString`. This affects:

- **`Model.findOneAndReplace(filter, replacement)`.** It always merges the replacement into the query's update, so a single call with an untrusted replacement is enough.
- **Update calls chained onto a query that already has an update.** For example `Model.updateOne(filter, { $set: {...} }).updateOne({}, untrustedUpdate)`, the same pattern with `findOneAndUpdate()`, or middleware that calls `this.updateOne(...)`.
- **`Query.prototype.merge()`** with a source query whose update came from untrusted input.

### Proof of concept

```js
const mongoose = require('mongoose');
const { Schema } = mongoose;

// 2. Setting dotted paths: a Mixed path on a default strict schema, nothing saved
const Item = mongoose.model('Item', new Schema({ name: String, meta: {} }));
new Item(JSON.parse('{"meta.toString.call": 1}'));  // e.g. new Item(req.body)
console.log(typeof Object.prototype.toString.call); // 'number'
// From here on, every query in the process fails:
// TypeError: _toString.call is not a function
```

```js
// 1. Loading documents: a stored field named after an Object.prototype method
const Loose = mongoose.model('Loose', new Schema({ name: String }, { strict: false }));
await new Loose(JSON.parse('{"name":"evil","toString":{"call":1}}')).save();
await Loose.findOne({ name: 'evil' });              // any later read of this document
await OtherModel.findOne();                         // TypeError: _toString.call is not a function
```

```js
// 3. Merging updates: a single findOneAndReplace() call with an untrusted replacement
const Doc = mongoose.model('Doc', new Schema({ name: String }));
Doc.findOneAndReplace({}, JSON.parse('{"toString":{"call":1}}'));
console.log(typeof Object.prototype.toString.call); // 'number'
```

```js
// 2. Setting dotted paths: changing the shared subdocument schema
const User = mongoose.model('User', new Schema({
  profile: new Schema({ email: { type: String, required: true } }, { strict: false })
}));
// e.g. JSON-patch style endpoint: doc.set(req.body.path, req.body.value)
new User({ profile: { email: 'a@b.c' } }).set('profile.$__schema.paths.email.validators', []);
await new User({ profile: {} }).validate();         // resolves: `required` removed for every document
```

### Impact

- **Denial of service (paths 1, 2 and 3).** One request overwrites `Object.prototype.toString.call`. After that, every query in the process fails, and so does much other code, until the process restarts. Ways in:
  - `new Model(req.body)` on any schema with a `Mixed` path;
  - `findOneAndReplace()` with an untrusted replacement;
  - reading one stored document that contains a field such as `{ "toString": { "call": 1 } }`.

  In the stored-document case, the attacker does not need any write path through Mongoose at the moment of the attack. Any later read of that document triggers the overwrite. If the document is read on startup or by a scheduled job, the application can be kept down.
- **Changes to shared state (path 2, `strict: false` subdocuments).** An attacker who controls the path passed to `doc.set(path, value)` can change a subdocument schema that every document shares. For example, they can remove validators or change schema options for every later document in the process.
- **Properties on built-in functions.** More generally, an attacker can attach properties they choose to built-in functions such as `Object.prototype.toString`, `Object.prototype.valueOf` and `Function.prototype.call`. Any other code that reads properties of those functions sees the attacker's values.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_