CVE-2026-125116 Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

What is CVE-2026-125116?

CVE-2026-125116 is a medium-severity vulnerability in Automattic mongoose, published on 9 Nov 2026.

Official description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

Weakness: CWE-843

Which versions are affected by CVE-2026-125116?

4 open source packages ship an affected version, including mongoose.

How do I fix CVE-2026-125116?

Upgrade mongoose to a fixed version for your release line: 6.13.12, 7.8.13, 8.24.7 or 9.11.4.

Is CVE-2026-125116 being exploited?

There is no known exploitation of CVE-2026-125116 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wr5m-5jph-8m96.