MO
Product
mongoose
3
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 1Low 0
Watch
Add mongoose to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-53900 | 9.1 | Dec 2 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection Affected: before 8.8.3 |
| CVE-2026-42334 | 7.5 | May 14 | Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection Affected: < 6.13.9; >= 7.0.0, <= 7.8.8; >= 8.0.0, <= 8.22.0; >= 9.0.0, <= 9.1.5 |
| CVE-2026-73562 | 6.5 | Aug 13 | Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) Affected: < 6.13.10; >= 7.0.0, < 7.8.10; >= 8.0.0, < 8.24.1; >= 9.0.0, < 9.7.2 |
Showing 3