AIKIDO-2026-943691
mongoose is vulnerable to NoSQL Injection
59
Medium Risk
This Affects:
mongooseTL;DR
Mongoose executes count, countDocuments, and cursor queries by casting the filter through a path that does not apply the sanitizeFilter option. When an application enables sanitizeFilter and passes user-controlled input into these query methods, embedded MongoDB query operators such as $ne or $where are not neutralized the way they are for other query methods. Untrusted operators can therefore alter query semantics or evaluate server-side predicates, defeating the sanitization the application relies on. The fix routes these executions through _castConditions, applying sanitizeFilter and rejecting disallowed operators.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application enables the sanitizeFilter option and passes user-controlled input directly into count, countDocuments, or cursor queries.
Background info
mongoose is vulnerable to NoSQL Injection in versions 9.0.0 - 9.9.1, 8.0.0 - 8.24.2, 7.0.0 - 7.8.11 and 6.0.0 - 6.13.10.
How to fix this
Upgrade the mongoose library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant