MEDIUM6.5npm
GHSA-664h-wqgq-64gw· BIT-mongoose-2026-73562, CVE-2026-73562Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Modified: 8/19/2026
package
npm/mongoose
pkg:npm/mongoose
CRITICAL9.1npm
GHSA-8687-vv9j-hgph· CVE-2019-17426Improper Input Validation in Automattic Mongoose
Modified: 11/29/2023
CRITICAL10.0npm
GHSA-9m93-w8w6-76hh· BIT-mongoose-2023-3696, CVE-2023-3696Mongoose Prototype Pollution vulnerability
Modified: 12/6/2023
HIGH7.0npm
GHSA-f825-f98c-gj3g· BIT-mongoose-2022-2564, CVE-2022-2564automattic/mongoose vulnerable to Prototype pollution via Schema.path
Modified: 12/6/2023
CRITICAL9.8npm
GHSA-h8hf-x3f4-xwgp· CVE-2022-24304Mongoose Vulnerable to Prototype Pollution in Schema Object
Modified: 4/22/2024
CRITICAL9.8npm
GHSA-m7xq-9374-9rvx· BIT-mongoose-2024-53900, CVE-2024-53900Mongoose search injection vulnerability
Modified: 2/5/2026
MEDIUM5.1npm
GHSA-r5xw-q988-826mRemote Memory Exposure in mongoose
Modified: 12/7/2023
CRITICAL9.0npm
GHSA-vg7j-7cwx-8wgw· BIT-mongoose-2025-23061, CVE-2025-23061Mongoose search injection vulnerability
Modified: 10/3/2025
HIGH7.5npm
GHSA-wpg9-53fq-2r8h· BIT-mongoose-2026-42334, CVE-2026-42334Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Modified: 5/18/2026