CVE-2026-125119: Connection-Level Filter Sanitization Bypass in Mongoose ODM

Vulnerability ID: CVE-2026-125119
CVSS Score: 7.5
Published: 2026-11-10

A flaw in Mongoose's query condition casting pipeline causes the sanitizeFilter configuration option to be silently ignored when defined at the connection level via mongoose.connect() or mongoose.createConnection(). Because internal query methods inspect Connection.options rather than Connection.config, applications relying on connection-scoped filter sanitization remain vulnerable to NoSQL query selector injection (CWE-943), permitting authentication bypass and unauthorized data access across Mongoose versions 6.x through 9.x.

TL;DR

Mongoose versions 6.0.0 through 9.11.3 ignore the sanitizeFilter: true option when passed to mongoose.connect() or mongoose.createConnection(). Attackers can supply MongoDB query operators (such as {"$ne": null}) in user input to bypass authentication and extract or modify database records.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-125119 (GHSA-gg4r-jv3p-qx3c)
• Weakness Class: CWE-943: Improper Neutralization of Special Elements in Data Query Logic
• Attack Vector: Network (Unauthenticated NoSQL Query Selector Injection)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
• EPSS Score: 0.54% (45.82nd Percentile)
• Impact: Authentication bypass, sensitive document disclosure, and filter tampering
• Affected Versions: 6.0.0 - 6.13.11, 7.0.0 - 7.8.12, 8.0.0 - 8.24.6, 9.0.0 - 9.11.3
• CISA KEV Status: Not Listed

Affected Systems

• Mongoose ODM (npm package: mongoose)
• Mongoose: >= 6.0.0, < 6.13.12 (Fixed in: 6.13.12)
• Mongoose: >= 7.0.0, < 7.8.13 (Fixed in: 7.8.13)
• Mongoose: >= 8.0.0, < 8.24.7 (Fixed in: 8.24.7)
• Mongoose: >= 9.0.0, < 9.11.4 (Fixed in: 9.11.4)

Code Analysis

Commit: 4bb6594

Fix connection-level sanitizeFilter lookup in Query._castConditions and Query.cast (v9.x branch)

--- a/lib/query.js
+++ b/lib/query.js
@@ -2405,14 +2405,10 @@ Query.prototype.mongooseOptions = function(v) {
  */

 Query.prototype._castConditions = function() {
-  let sanitizeFilterOpt = undefined;
-  if (this.model?.db.options?.sanitizeFilter != null) {
-    sanitizeFilterOpt = this.model.db.options.sanitizeFilter;
-  } else if (this.model?.base.options?.sanitizeFilter != null) {
-    sanitizeFilterOpt = this.model.base.options.sanitizeFilter;
-  } else {
-    sanitizeFilterOpt = this._mongooseOptions.sanitizeFilter;
-  }
+  const sanitizeFilterOpt = this.model?.db.config?.sanitizeFilter ??
+    this.model?.db.options?.sanitizeFilter ??
+    this.model?.base.options.sanitizeFilter ??
+    this._mongooseOptions.sanitizeFilter;

   if (sanitizeFilterOpt) {
     sanitizeFilter(this._conditions);
@@ -5243,9 +5239,10 @@ Query.prototype.cast = function(model, obj) {
   if ('strictQuery' in this._mongooseOptions) {
     opts.strictQuery = this._mongooseOptions.strictQuery;
   }
-  if ('sanitizeFilter' in this._mongooseOptions) {
-    opts.sanitizeFilter = this._mongooseOptions.sanitizeFilter;
-  }
+  opts.sanitizeFilter = model.db.config?.sanitizeFilter ??
+    model.db.options?.sanitizeFilter ??
+    model.base.options.sanitizeFilter ??
+    this._mongooseOptions.sanitizeFilter;

   try {
     return cast(model.schema, obj, opts, this);

Commit: 4f4f9a7

Backport connection-level sanitizeFilter fix to v8.x branch

Commit: 83eda6a

Backport connection-level sanitizeFilter fix to v7.x branch

Commit: b8970c2

Backport connection-level sanitizeFilter fix and castQuery update to v6.x branch

Mitigation Strategies

• Upgrade Mongoose to a patched version (6.13.12, 7.8.13, 8.24.7, or 9.11.4) that inspects Connection.config.sanitizeFilter during query condition casting.
• Enable filter sanitization globally using mongoose.set('sanitizeFilter', true) instead of relying solely on connection-level options.
• Enforce strict runtime schema validation (e.g., via Zod or Joi) on incoming HTTP request bodies and query parameters to reject non-primitive objects and arrays.
• Use explicit $eq query operators or cast user-supplied values to scalar types before passing them to Mongoose query methods.

Remediation Steps:

1. Audit package.json and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to identify Mongoose versions within the ranges >=6.0.0 <6.13.12, >=7.0.0 <7.8.13, >=8.0.0 <8.24.7, or >=9.0.0 <9.11.4.
2. Search the codebase for calls to mongoose.connect() and mongoose.createConnection() that pass { sanitizeFilter: true }.
3. Update the mongoose dependency to >=6.13.12, >=7.8.13, >=8.24.7, or >=9.11.4 using npm update mongoose or equivalent package manager commands.
4. If immediate patching is blocked, add mongoose.set('sanitizeFilter', true) to the database initialization module and verify that untrusted operator payloads trigger CastError exceptions in integration tests.

References

• GitHub Security Advisory: GHSA-gg4r-jv3p-qx3c
• CVE-2026-125119 Record on CVE.org
• NVD Detail for CVE-2026-125119
• Fix Commit for Mongoose v9.x Branch (4bb659478be2f30655a7bdd78bc251bdf111cd29)
• Fix Commit for Mongoose v8.x Branch (4f4f9a79f860786a54133bee2c9af967ec691491)
• Fix Commit for Mongoose v7.x Branch (83eda6af1489e9ef60bb8eee8cf9ee005771b9d5)
• Fix Commit for Mongoose v6.x Branch (b8970c25998c23fbccd17f76c0398b902ff4911d)

Read the full report for CVE-2026-125119 on our website for more details including interactive diagrams and full exploit analysis.