{"id":"CVE-2026-125120","kind":"vulnerability","aliases":["CVE-2026-125120","GHSA-pcrw-h46h-c93h"],"related":[],"title":"Mongoose: sanitizeFilter not applied on countDocuments","description":"### Impact\n\n`sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanitizeFilter` was not applied for `countDocuments()` queries.\n\n### Patches\n\nPatches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.\n\n1. `^9.9.2`\n2. `^8.24.3`\n3. `^7.8.12`\n4. `^6.13.11`\n\n### Workarounds\n\nMiddleware:\n\n```javascript\nmongoose.plugin(function() {\n  schema.pre('countDocuments', function() {\n    // This will always apply `sanitizeFilter` on `countDocuments`\n    mongoose.sanitizeFilter(this.getFilter());\n  });\n});\n```","summary":"Mongoose's sanitizeFilter protects against query selector injection, but older versions did not apply it to countDocuments() queries. An attacker who can pass unsanitized input into a count query can inject MongoDB operators and change what the query matches.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongoose","fixed":["6.13.11"],"affected":"< 6.13.11","ecosystem":"npm"},{"name":"mongoose","fixed":["7.8.12"],"affected":">= 7.0.0, < 7.8.12","ecosystem":"npm"},{"name":"mongoose","fixed":["8.24.3"],"affected":">= 8.0.0, < 8.24.3","ecosystem":"npm"},{"name":"mongoose","fixed":["9.9.2"],"affected":">= 9.0.0, < 9.9.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-943","mongodb","mongoose","node","npm","package"],"not_affected_if":["default-config-no-user-filters","fixed-version"],"how_to_check":"- Run `npm ls mongoose` in the project to see which version is installed.\n- Check whether `sanitizeFilter` is enabled and whether app code passes request input into `countDocuments()` filters.","fix":"- Upgrade to `9.9.2` on the 9.x line.\n- Upgrade to `8.24.3` on the 8.x line.\n- Upgrade to `7.8.12` on the 7.x line.\n- Upgrade to `6.13.11` on the 6.x line.","status":"open","published_at":"2026-11-09T23:17:22+00:00","first_seen_at":"2026-11-10T19:40:05+00:00","triaged_at":"2026-11-10T19:42:15+00:00","updated_at":"2026-11-10T20:15:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T19:42:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `9.9.2` on the 9.x line.\n- Upgrade to `8.24.3` on the 8.x line.\n- Upgrade to `7.8.12` on the 7.x line.\n- Upgrade to `6.13.11` on the 6.x line.","reach":"internet","title":"Mongoose: query sanitizer skipped on countDocuments, allowing query selector injection","impact":"high","summary":"Mongoose's sanitizeFilter protects against query selector injection, but older versions did not apply it to countDocuments() queries. An attacker who can pass unsanitized input into a count query can inject MongoDB operators and change what the query matches.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongoose","node","mongodb","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker alters query filters and reads or counts data they should not see","analyst_note":"","how_to_check":"- Run `npm ls mongoose` in the project to see which version is installed.\n- Check whether `sanitizeFilter` is enabled and whether app code passes request input into `countDocuments()` filters.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config-no-user-filters","fixed-version"],"who_is_affected":"Applications that use a Mongoose version below the fixed release on their major line and pass user-controlled input into countDocuments() filters are exposed. Apps that do not use countDocuments with request data, or that already apply the sanitizeFilter middleware workaround, are less exposed. Tools that never take external input to build queries can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000804,"input_tokens":5012,"output_tokens":605,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125120':9A,17A '-2026':8A,16A '-943':23B '1':121C '2':123C '3':125C '4':127C '6.13.11':128C '7.8.12':126C '8.24.3':124C '9.9.2':122C 'alway':139C 'appli':4A,42B,89C,140C 'applic':118C 'attack':48B,80C 'c93h':14A 'chang':63B 'count':56B 'countdocu':6A,45B,91C,135C,143C 'cve':7A,15A 'cwe':22B 'depend':111C 'follow':109C 'function':133C,136C 'ghsa':11A 'ghsa-pcrw-h46h-c93h':10A 'h46h':13A 'impact':68C 'inject':36B,59B,79C 'input':53B 'javascript':131C 'line':104C 'major':102C,114C 'match':67B 'mechan':73C 'middlewar':130C 'mongodb':24B,60B 'mongoos':1A,25B,29B,71C,85C,101C,117C 'mongoose':18A,19A,20A,21A 'mongoose.plugin':132C 'mongoose.sanitizefilter':144C 'node':26B 'npm':27B 'older':38B,82C 'oper':61B 'packag':28B 'pass':51B 'patch':93C,94C 'pcrw':12A 'pleas':105C 'protect':32B,75C 'queri':34B,46B,57B,66B,77C,92C 'releas':97C,103C 'sanitizefilt':2A,31B,69C,86C,141C 'schema.pre':134C 'selector':35B,78C 'support':100C 'this.getfilter':145C 'unsanit':52B 'upgrad':106C 'use':120C 'version':39B,83C,110C,115C 'workaround':129C","nicknames":[],"mitigations":[],"who_affected":"Applications that use a Mongoose version below the fixed release on their major line and pass user-controlled input into countDocuments() filters are exposed. Apps that do not use countDocuments with request data, or that already apply the sanitizeFilter middleware workaround, are less exposed. Tools that never take external input to build queries can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mongoose"],"ptokens":["mongoose"],"labels":["critical","cwe943","mongodb","mongoose","node","npm","package"],"campaign_type":null,"search_a":"'-125120':9A,17A '-2026':8A,16A 'appli':4A 'c93h':14A 'countdocu':6A 'cve':7A,15A 'ghsa':11A 'ghsa-pcrw-h46h-c93h':10A 'h46h':13A 'mongoos':1A 'mongoose':18A,19A,20A,21A 'pcrw':12A 'sanitizefilt':2A","search_b":"'-943':23B 'appli':42B 'attack':48B 'chang':63B 'count':56B 'countdocu':45B 'cwe':22B 'inject':36B,59B 'input':53B 'match':67B 'mongodb':24B,60B 'mongoos':25B,29B 'node':26B 'npm':27B 'older':38B 'oper':61B 'packag':28B 'pass':51B 'protect':32B 'queri':34B,46B,57B,66B 'sanitizefilt':31B 'selector':35B 'unsanit':52B 'version':39B","search_c":"'1':121C '2':123C '3':125C '4':127C '6.13.11':128C '7.8.12':126C '8.24.3':124C '9.9.2':122C 'alway':139C 'appli':89C,140C 'applic':118C 'attack':80C 'countdocu':91C,135C,143C 'depend':111C 'follow':109C 'function':133C,136C 'impact':68C 'inject':79C 'javascript':131C 'line':104C 'major':102C,114C 'mechan':73C 'middlewar':130C 'mongoos':71C,85C,101C,117C 'mongoose.plugin':132C 'mongoose.sanitizefilter':144C 'older':82C 'patch':93C,94C 'pleas':105C 'protect':75C 'queri':77C,92C 'releas':97C,103C 'sanitizefilt':69C,86C,141C 'schema.pre':134C 'selector':78C 'support':100C 'this.getfilter':145C 'upgrad':106C 'use':120C 'version':83C,110C,115C 'workaround':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T19:26:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pcrw-h46h-c93h","url":"https://github.com/advisories/GHSA-pcrw-h46h-c93h","severity":"critical","published_at":"2026-11-10T19:37:32+00:00","modified_at":"2026-11-10T19:37:33+00:00","first_seen_at":"2026-11-10T19:40:05+00:00","fetched_at":"2026-11-10T20:56:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-125120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125120","severity":null,"published_at":"2026-11-09T23:17:22+00:00","modified_at":"2026-11-09T23:17:22+00:00","first_seen_at":"2026-11-10T20:15:32+00:00","fetched_at":"2026-11-10T20:15:32+00:00","note":null}],"documents":[{"id":117626,"url":"https://api.github.com/repos/Automattic/mongoose/security-advisories/GHSA-pcrw-h46h-c93h","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":117627,"url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-02T19:26:11+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":117628,"url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117629,"url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117630,"url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117631,"url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117632,"url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":117633,"url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":117634,"url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":117635,"url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}