{"id":"GHSA-pcrw-h46h-c93h","summary":"Mongoose: sanitizeFilter not applied on countDocuments","details":"### Impact\n\n`sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanitizeFilter` was not applied for `countDocuments()` queries.\n\n### Patches\n\nPatches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.\n\n1. `^9.9.2`\n2. `^8.24.3`\n3. `^7.8.12`\n4. `^6.13.11`\n\n### Workarounds\n\nMiddleware:\n\n```javascript\nmongoose.plugin(function() {\n  schema.pre('countDocuments', function() {\n    // This will always apply `sanitizeFilter` on `countDocuments`\n    mongoose.sanitizeFilter(this.getFilter());\n  });\n});\n```","aliases":["CVE-2026-125120"],"modified":"2026-11-10T19:45:09.663513148Z","published":"2026-11-10T19:37:32Z","database_specific":{"cwe_ids":["CWE-943"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-11-10T19:37:32Z","nvd_published_at":"2026-11-09T23:17:22Z"},"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125120"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2"}],"affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}