MONGOOSE · CVE-2026-125119 · Package
FIX → 9.11.4 · 8.24.7 · 7.8.13 · 6.13.12
Mongoose's sanitizeFilter option, set when creating a connection, is reported as enabled but never applied to query filters. An attacker who sends an object such as { $ne: null } as a password can match the record without knowing the value and read the account data.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the Mongoose ODM with MongoDB and turn on sanitizeFilter in the connection options rather than globally or per query. Affected only when attacker-controlled objects reach filter values. Applications that set sanitizeFilter globally with mongoose.set or per query with .sanitizeFilter() are not affected.
Not affected if global-sanitizefilter, no-user-controlled-filters, per-query-sanitizefilter
Who cares express, mongodb, mongoose, node
npm ls mongoosesanitizeFilter passed to mongoose.connect() or rather than or on queriessanitizeFilter exists to stop query selector injection: it wraps operator objects such as { $ne: null } in filter values in $eq, so they are matched literally. Set on a connection with mongoose.connect() or createConnection(uri, { sanitizeFilter: true }), the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of { $ne: null } returns the account record without the password.
NativeConnection#createClient() at lib/drivers/node-mongodb-native/connection.js:270-272 moves options.sanitizeFilter into Connection.config and deletes the original option. Query#_castConditions() at lib/query.js:2413-2423 checks , the global , and the per-query options, but never . The defense therefore does not run even though returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
createConnection()mongoose.set('sanitizeFilter').sanitizeFilter()Upgrade to 9.11.4 · 8.24.7 · 7.8.13 · 6.13.12
6.13.127.8.138.24.79.11.4Connection.optionsoptionsConnection.configConnection#get('sanitizeFilter')import mongoose from 'mongoose'
const conn = await mongoose.createConnection('<MONGODB_URI>', { sanitizeFilter: true }).asPromise()
const User = conn.model('User', new mongoose.Schema({
username: String,
password: String,
marker: String
}))
await User.create({
username: 'victim',
password: 'correct-password',
marker: 'PROTECTED_RECORD'
})
const filter = { username: 'victim', password: { $ne: null } }
console.log(conn.get('sanitizeFilter'))
console.log((await User.findOne(filter).lean()).marker)
A control query with a literal wrong password returned no document in the same run, confirming the filter is otherwise enforced.
Connection-level sanitizeFilter option is not respected. Any user that relies on connection-level config and sanitizeFilter to defend against query selector injection is affected. Users that set sanitizeFilter globally using mongoose.set('sanitizeFilter') or on specific queries using Model.find().sanitizeFilter() are not affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.