---
id: "CVE-2026-125119"
page: "https://infrastack.ai/live/CVE-2026-125119"
kind: "vulnerability"
aliases: ["CVE-2026-125119", "GHSA-gg4r-jv3p-qx3c"]
title: "Mongoose: Connection-level sanitizeFilter not applied"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongoose", "fixed": ["6.13.12"], "affected": ">= 6.0.0, < 6.13.12", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["7.8.13"], "affected": ">= 7.0.0, < 7.8.13", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["8.24.7"], "affected": ">= 8.0.0, < 8.24.7", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["9.11.4"], "affected": ">= 9.0.0, < 9.11.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-943", "express", "mongodb", "mongoose", "node", "package"]
not_affected_if: ["global-sanitizefilter", "no-user-controlled-filters", "per-query-sanitizefilter"]
published_at: "2026-11-09T23:17:22+00:00"
first_seen_at: "2026-11-10T20:00:16+00:00"
updated_at: "2026-11-10T20:15:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gg4r-jv3p-qx3c", "first_seen_at": "2026-11-10T20:00:16+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125119", "first_seen_at": "2026-11-10T20:15:32+00:00"}]
exploit_sources: []
---

# Mongoose: Connection-level sanitizeFilter not applied

Link for people: https://infrastack.ai/live/CVE-2026-125119 (this .md is for agents)

Mongoose's sanitizeFilter option, set when creating a connection, is reported as enabled but never applied to query filters. An attacker who sends an object such as { $ne: null } as a password can match the record without knowing the value and read the account data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mongoose affected >= 6.0.0, < 6.13.12 fixed 6.13.12
- npm:mongoose affected >= 7.0.0, < 7.8.13 fixed 7.8.13
- npm:mongoose affected >= 8.0.0, < 8.24.7 fixed 8.24.7
- npm:mongoose affected >= 9.0.0, < 9.11.4 fixed 9.11.4

## How to check

- Check the installed version: `npm ls mongoose`
- Search code for `sanitizeFilter` passed to `mongoose.connect()` or `createConnection()` rather than `mongoose.set('sanitizeFilter')` or `.sanitizeFilter()` on queries
- Check whether user-supplied request bodies or query strings are passed directly into filter objects

## Fix

- mongoose 6.x: `6.13.12`
- mongoose 7.x: `7.8.13`
- mongoose 8.x: `8.24.7`
- mongoose 9.x: `9.11.4`

## Timeline

- 2026-11-10T20:00:16+00:00 ghsa https://github.com/advisories/GHSA-gg4r-jv3p-qx3c
- 2026-11-10T20:15:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125119

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/Automattic/mongoose/security-advisories/GHSA-gg4r-jv3p-qx3c
- [advisory] Maintainer's advisory: github.com https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/6.13.12
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/7.8.13
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/8.24.7
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/9.11.4

## From the sources

### Summary

sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of `{ $ne: null }` returns the account record without the password.

### Details

`NativeConnection#createClient()` at `lib/drivers/node-mongodb-native/connection.js:270-272` moves `options.sanitizeFilter` into `Connection.config` and deletes the original option. `Query#_castConditions()` at `lib/query.js:2413-2423` checks `Connection.options`, the global `options`, and the per-query options, but never `Connection.config`. The defense therefore does not run even though `Connection#get('sanitizeFilter')` returns true. This storage was introduced in Mongoose 6.0.0 and the same mismatch is present in 9.11.2.

### Proof of concept

```javascript
import mongoose from 'mongoose'

const conn = await mongoose.createConnection('<MONGODB_URI>', { sanitizeFilter: true }).asPromise()
const User = conn.model('User', new mongoose.Schema({
  username: String,
  password: String,
  marker: String
}))

await User.create({
  username: 'victim',
  password: 'correct-password',
  marker: 'PROTECTED_RECORD'
})

const filter = { username: 'victim', password: { $ne: null } }
console.log(conn.get('sanitizeFilter'))
console.log((await User.findOne(filter).lean()).marker)
```

A control query with a literal wrong password returned no document in the same run, confirming the filter is otherwise enforced.

### Impact

Connection-level `sanitizeFilter` option is not respected. Any user that relies on connection-level config and `sanitizeFilter` to defend against query selector injection is affected. Users that set `sanitizeFilter` globally using `mongoose.set('sanitizeFilter')` or on specific queries using `Model.find().sanitizeFilter()` are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_