mongoose

Mongoose MongoDB ODM

Latest 9.11.1

NPM

96%

Total Score

healthy

Long-running, actively maintained release with strong repository backing and only minor workflow hygiene findings.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All nine workflows were analyzed with no untrusted checkouts or script injection; two top-level write-permission workflows and eight of 37 unpinned uses are mild hygiene concerns, while the low-confidence cache finding is not decisive.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-943691 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mongoose is vulnerable to NoSQL Injection in versions 9.0.0 - 9.9.1, 8.0.0 - 8.24.2, 7.0.0 - 7.8.11 and 6.0.0 - 6.13.10.	6.0.0 - 6.13.107.0.0 - 7.8.118.0.0 - 8.24.2 +1 more	Medium
CVE-2026-73562 mongoose is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.13.10, 7.0.0 - 7.8.10, 8.0.0 - 8.24.1 and 9.0.0 - 9.7.2.	0.0.0 - 6.13.107.0.0 - 7.8.108.0.0 - 8.24.1 +1 more	Medium
CVE-2026-42334 mongoose is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 6.13.9, 7.0.0 - 7.8.8, 8.0.0 - 8.22.0 and 9.0.0 - 9.1.5.	0.0.0 - 6.13.97.0.0 - 7.8.88.0.0 - 8.22.0 +1 more	High
CVE-2025-23061 mongoose is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 8.0.0-rc0 - 8.9.5, 7.0.0-rc0 - 7.8.4 and 0.0.0 - 6.13.6.	0.0.0 - 6.13.67.0.0-rc0 - 7.8.48.0.0-rc0 - 8.9.5	Critical
AIKIDO-2024-10481 mongoose is vulnerable to NoSQL Injection in versions 5.6.4 - 8.8.2.	5.6.4 - 8.8.2	Critical