Mongoosejs
Mongoosejs Mongoose: vulnerabilidades y CVE
Mongoosejs Mongoose tiene 6 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE6
Últimos 12 meses1
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-42334 | Alta (7.5) | 0.46% | — | 14 may 2026 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization… |
| CVE-2025-23061 | Crítica (9.8) | 7.3% | — | 15 ene 2025 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. |
| CVE-2024-53900 | Crítica (9.1) | 4.0% | — | 2 dic 2024 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. |
| CVE-2023-3696 | Crítica (9.8) | 1.2% | — | 17 jul 2023 | Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. |
| CVE-2022-2564 | Crítica (9.8) | 33% | — | 28 jul 2022 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. |
| CVE-2019-17426 | Crítica (9.1) | 1.7% | — | 10 oct 2019 | Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes… |