CVE-2026-125120: Mongoose: sanitizeFilter not applied on countDocuments
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 6.13.11 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 7.8.12 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 8.24.3 - Upgrade
Upgrade
mongooseto a version that resolves this vulnerability.Fixed in 9.9.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they enable Mongoose's sanitizeFilter option and pass attacker-controlled filter values to countDocuments(). The issue affects Mongoose versions before 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
What does an attacker need to exploit it?
An attacker needs a way to supply filter values used by the application's countDocuments() call. Crafted query operator objects can then be interpreted as MongoDB operators instead of literal values.
What is the practical impact?
The returned count can include documents that should not match the intended filter. This can undermine authorization decisions or other application logic that relies on the count.
How can this be remediated?
Upgrade Mongoose to 6.13.11, 7.8.12, 8.24.3, 9.9.2, or a later version in the applicable release line.