CVE-2022-2564 Prototype Pollution in automattic/mongoose
Prototype pollution in Mongoose allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2564?
CVE-2022-2564 is a high-severity vulnerability in automattic/mongoose, published on 28 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Weakness: CWE-1321
Which versions are affected by CVE-2022-2564?
5 open source packages ship an affected version, including mongoose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongoose Bitnami | All versions | 5.13.15, 6.4.6 |
mongoose npm | All versions | 5.13.15 |
mongoose npm | All versions | 5.13.15 |
mongoose npm | From 6.0.0 | 6.4.6 |
mongoose npm | From 6.0.0 | 6.4.6 |
Products include Mongoosejs Mongoose.
How do I fix CVE-2022-2564?
Upgrade mongoose to a fixed version for your release line: 5.13.15 or 6.4.6.
Is CVE-2022-2564 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2564 exists.
Other vulnerabilities in automattic/mongoose
- CVE-2023-3696 Prototype Pollution in automattic/mongoose
- CVE-2024-53900 Mongoose search injection vulnerability
- CVE-2019-17426 Improper Input Validation in Automattic Mongoose
- CVE-2025-23061 Mongoose search injection vulnerability
- CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Sources
Also known as BIT-mongoose-2022-2564, CVE-2022-24304, GHSA-f825-f98c-gj3g.