MONGOOSE · CVE-2026-125120 · Package
FIX → 9.9.2 · 8.24.3 · 7.8.12 · 6.13.11
Mongoose's sanitizeFilter protects against query selector injection, but older versions did not apply it to countDocuments() queries. An attacker who can pass unsanitized input into a count query can inject MongoDB operators and change what the query matches.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use a Mongoose version below the fixed release on their major line and pass user-controlled input into countDocuments() filters are exposed. Apps that do not use countDocuments with request data, or that already apply the sanitizeFilter middleware workaround, are less exposed. Tools that never take external input to build queries can skip it.
Not affected if default-config-no-user-filters, fixed-version
Who cares mongodb, mongoose, node, npm
npm ls mongoose in the project to see which version is installed.sanitizeFilter is enabled and whether app code passes request input into filters.sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries.
Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.
^9.9.2^8.24.3^7.8.12^6.13.11Middleware:
mongoose.plugin(function() {
schema.pre('countDocuments', function() {
mongoose.(.());
});
});
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
countDocuments()Upgrade to 9.9.2 · 8.24.3 · 7.8.12 · 6.13.11
9.9.2 on the 9.x line.8.24.3 on the 8.x line.7.8.12 on the 7.x line.6.13.11 on the 6.x line.This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.