CVE-2019-17426 Improper Input Validation in Automattic Mongoose
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2019-17426?
CVE-2019-17426 is a critical vulnerability in n/a, published on 10 Oct 2019.
Official description
Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Which versions are affected by CVE-2019-17426?
4 open source packages ship an affected version, including mongoose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongoose npm | All versions | 4.13.21 |
mongoose npm | All versions | 4.13.21 |
mongoose npm | From 5.0.0 | 5.7.5 |
mongoose npm | From 5.0.0 | 5.7.5 |
Products include Mongoosejs Mongoose.
How do I fix CVE-2019-17426?
Upgrade mongoose to a fixed version for your release line: 4.13.21 or 5.7.5.
Is CVE-2019-17426 being exploited?
There is no known exploitation of CVE-2019-17426 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-3696 Prototype Pollution in automattic/mongoose
- CVE-2024-53900 Mongoose search injection vulnerability
- CVE-2025-23061 Mongoose search injection vulnerability
- CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
- CVE-2022-2564 Prototype Pollution in automattic/mongoose
Sources
Also known as GHSA-8687-vv9j-hgph.