CVE-2026-125119 Mongoose: Connection-level sanitizeFilter not applied
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125119?
CVE-2026-125119 is a high-severity vulnerability in Automattic mongoose, published on 9 Nov 2026.
Official description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Weakness: CWE-943
Which versions are affected by CVE-2026-125119?
4 open source packages ship an affected version, including mongoose.
| Package | Affected | Fixed in |
|---|---|---|
mongoose npm | From 6.0.0 | 6.13.12 |
mongoose npm | From 7.0.0 | 7.8.13 |
mongoose npm | From 8.0.0 | 8.24.7 |
mongoose npm | From 9.0.0 | 9.11.4 |
How do I fix CVE-2026-125119?
Upgrade mongoose to a fixed version for your release line: 6.13.12, 7.8.13, 8.24.7 or 9.11.4.
Is CVE-2026-125119 being exploited?
There is no known exploitation of CVE-2026-125119 in the wild and no public exploit code.
Sources
Also known as GHSA-gg4r-jv3p-qx3c.