CVE-2026-125119: Mongoose: Connection-level sanitizeFilter not applied
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 6.13.12 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.8.13 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 8.24.7 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 9.11.4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Mongoose versions from 6.0.0 up to the fixed releases are exposed if they enable sanitizeFilter only through mongoose.connect() or createConnection() and pass attacker-controlled objects into query filters. The global mongoose.set('sanitizeFilter') setting and per-query Model.find().sanitizeFilter() are not affected.
What does an attacker need to exploit it?
An attacker needs a way to supply an object as part of a query filter, such as a password value used in an account lookup. A crafted query operator in that object can match an account record without providing the expected literal password.
How can we determine whether our configured protection is ineffective?
Review how sanitizeFilter is enabled. If it is configured only as a connection option through mongoose.connect() or createConnection(), the connection may report that sanitizeFilter is enabled even though query selector objects are not sanitized.
What can we do if upgrading is not immediately possible?
Use the global mongoose.set('sanitizeFilter') configuration or apply sanitizeFilter on each relevant query with Model.find().sanitizeFilter(), since those configuration paths are unaffected. Also avoid passing attacker-controlled objects directly into query filters.
Which versions contain fixes?
The issue is fixed in Mongoose 6.13.12, 7.8.13, 8.24.7, and 9.11.4.