What’s Vulnerable › Products

automattic/mongoose vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your automattic/mongoose version is affected

Latest automattic/mongoose vulnerabilities

• CVE-2026-73562 — Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) (CVSS 6.5)
• CVE-2026-42334 — Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection (CVSS 7.5)
• CVE-2025-23061 — (CVSS 9.8)
• CVE-2024-53900 — (CVSS 9.1)
• CVE-2023-3696 — Prototype Pollution in automattic/mongoose (CVSS 9.8)
• CVE-2022-2564 — Prototype Pollution in automattic/mongoose (CVSS 9.8)
• CVE-2019-17426 — (CVSS 9.1)