---
id: "CVE-2026-125120"
page: "https://infrastack.ai/live/CVE-2026-125120"
kind: "vulnerability"
aliases: ["CVE-2026-125120", "GHSA-pcrw-h46h-c93h"]
title: "Mongoose: sanitizeFilter not applied on countDocuments"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongoose", "fixed": ["6.13.11"], "affected": "< 6.13.11", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["7.8.12"], "affected": ">= 7.0.0, < 7.8.12", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["8.24.3"], "affected": ">= 8.0.0, < 8.24.3", "ecosystem": "npm"}, {"name": "mongoose", "fixed": ["9.9.2"], "affected": ">= 9.0.0, < 9.9.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-943", "mongodb", "mongoose", "node", "npm", "package"]
not_affected_if: ["default-config-no-user-filters", "fixed-version"]
published_at: "2026-11-09T23:17:22+00:00"
first_seen_at: "2026-11-10T19:40:05+00:00"
updated_at: "2026-11-10T20:15:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pcrw-h46h-c93h", "first_seen_at": "2026-11-10T19:40:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125120", "first_seen_at": "2026-11-10T20:15:32+00:00"}]
exploit_sources: []
---

# Mongoose: sanitizeFilter not applied on countDocuments

Link for people: https://infrastack.ai/live/CVE-2026-125120 (this .md is for agents)

Mongoose's sanitizeFilter protects against query selector injection, but older versions did not apply it to countDocuments() queries. An attacker who can pass unsanitized input into a count query can inject MongoDB operators and change what the query matches.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:mongoose affected < 6.13.11 fixed 6.13.11
- npm:mongoose affected >= 7.0.0, < 7.8.12 fixed 7.8.12
- npm:mongoose affected >= 8.0.0, < 8.24.3 fixed 8.24.3
- npm:mongoose affected >= 9.0.0, < 9.9.2 fixed 9.9.2

## How to check

- Run `npm ls mongoose` in the project to see which version is installed.
- Check whether `sanitizeFilter` is enabled and whether app code passes request input into `countDocuments()` filters.

## Fix

- Upgrade to `9.9.2` on the 9.x line.
- Upgrade to `8.24.3` on the 8.x line.
- Upgrade to `7.8.12` on the 7.x line.
- Upgrade to `6.13.11` on the 6.x line.

## Timeline

- 2026-11-10T19:40:05+00:00 ghsa https://github.com/advisories/GHSA-pcrw-h46h-c93h
- 2026-11-10T20:15:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125120

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/Automattic/mongoose/security-advisories/GHSA-pcrw-h46h-c93h
- [advisory] Maintainer's advisory: github.com https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d
- [fix] Patch: github.com https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/6.13.11
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/7.8.12
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/8.24.3
- [fix] Release: github.com https://github.com/Automattic/mongoose/releases/tag/9.9.2

## From the sources

### Impact

`sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanitizeFilter` was not applied for `countDocuments()` queries.

### Patches

Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.

1. `^9.9.2`
2. `^8.24.3`
3. `^7.8.12`
4. `^6.13.11`

### Workarounds

Middleware:

```javascript
mongoose.plugin(function() {
  schema.pre('countDocuments', function() {
    // This will always apply `sanitizeFilter` on `countDocuments`
    mongoose.sanitizeFilter(this.getFilter());
  });
});
```

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_