CVE-2026-42334 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Attackers can bypass query sanitization via the $nor operator to inject malicious NoSQL queries, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42334?
CVE-2026-42334 is a high-severity SQL injection vulnerability in Automattic mongoose, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
Weakness: CWE-74
Which versions are affected by CVE-2026-42334?
9 open source packages ship an affected version, including mongoose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongoose Bitnami | All versions | 6.13.9, 7.8.9, 8.22.1, 9.1.6 |
mongoose npm | All versions | 6.13.9 |
mongoose npm | All versions | 6.13.9 |
mongoose npm | From 7.0.0 | 7.8.9 |
mongoose npm | From 7.0.0 | 7.8.9 |
mongoose npm | From 8.0.0 | 8.22.1 |
3 more packages
mongoose npm | From 8.0.0 | 8.22.1 |
mongoose npm | From 9.0.0 | 9.1.6 |
mongoose npm | From 9.0.0 | 9.1.6 |
Products include Mongoosejs Mongoose.
How do I fix CVE-2026-42334?
Upgrade mongoose to a fixed version for your release line: 6.13.9, 7.8.9, 8.22.1 or 9.1.6.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42334 being exploited?
There is no known exploitation of CVE-2026-42334 in the wild and no public exploit code.
Other vulnerabilities in Automattic mongoose
Sources
Also known as BIT-mongoose-2026-42334, CLSA-2026-1783558972, GHSA-wpg9-53fq-2r8h, ROOT-APP-NPM-CVE-2026-42334.