CVE-2026-125118: Mongoose: Prototype pollution via Schema.prototype.virtual()
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as proto, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 6.13.12 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 7.8.13 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 8.24.7 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 9.11.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed to exploitation?
Deployments are exposed when untrusted users can influence virtual field names in dynamically generated schemas, content-management form builders, or schema-as-code systems. Applications with only developer-controlled virtual names are not identified as an exploitation path in the available data.
What does an attacker need to supply?
An attacker needs influence over virtual field names and must be able to include special path segments such as __proto__, constructor, or prototype. No authentication or user interaction is required according to the supplied vector.
What can prototype pollution enable in an affected application?
The issue can add enumerable properties to Object.prototype or Function.prototype. This may spoof inherited-property checks, including authorization flags, and provide function-prototype gadget state to other server-side JavaScript code.
Which Mongoose releases contain the fix?
The fix is available in Mongoose 6.13.12, 7.8.13, 8.24.7, and 9.11.4. Versions prior to those releases in their respective release lines are affected.