CVE-2026-125120 Mongoose: sanitizeFilter not applied on countDocuments
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125120?
CVE-2026-125120 is a critical vulnerability in Automattic mongoose, published on 9 Nov 2026.
Official description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
Weakness: CWE-943
Which versions are affected by CVE-2026-125120?
4 open source packages ship an affected version, including mongoose.
| Package | Affected | Fixed in |
|---|---|---|
mongoose npm | All versions | 6.13.11 |
mongoose npm | From 7.0.0 | 7.8.12 |
mongoose npm | From 8.0.0 | 8.24.3 |
mongoose npm | From 9.0.0 | 9.9.2 |
How do I fix CVE-2026-125120?
Upgrade mongoose to a fixed version for your release line: 6.13.11, 7.8.12, 8.24.3 or 9.9.2.
Is CVE-2026-125120 being exploited?
There is no known exploitation of CVE-2026-125120 in the wild and no public exploit code.
Sources
Also known as GHSA-pcrw-h46h-c93h.