CVE-2026-125118 Mongoose: Prototype pollution via Schema.prototype.virtual()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125118?
CVE-2026-125118 is a medium-severity vulnerability in Automattic mongoose, published on 9 Nov 2026.
Official description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Weakness: CWE-1321
Which versions are affected by CVE-2026-125118?
4 open source packages ship an affected version, including mongoose.
| Package | Affected | Fixed in |
|---|---|---|
mongoose npm | All versions | 6.13.12 |
mongoose npm | From 7.0.0 | 7.8.13 |
mongoose npm | From 8.0.0 | 8.24.7 |
mongoose npm | From 9.0.0 | 9.11.4 |
How do I fix CVE-2026-125118?
Upgrade mongoose to a fixed version for your release line: 6.13.12, 7.8.13, 8.24.7 or 9.11.4.
Is CVE-2026-125118 being exploited?
There is no known exploitation of CVE-2026-125118 in the wild and no public exploit code.
Sources
Also known as GHSA-6972-9mcm-vhwj.