Read the docs
TI-2026-30638 Aliases CVE-2026-42334GHSA-wpg9-53fq-2r8h

Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Priority LOW 39CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed mongoose (Automattic): 6.13.9mongoose (npm): 6.13.9, 7.8.9, 8.22.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Automatticmongoosebefore 6.13.9; 7.0.0 – 7.8.8; 8.0.0 – 8.22.0; 9.0.0 – 9.1.56.13.9Patch availableCNA
—mongoose (npm)before 6.13.96.13.9Patch availableGHSA-wpg9-53fq-2r8h
—mongoose (npm)7.0.0 to before 7.8.97.8.9Patch availableGHSA-wpg9-53fq-2r8h
—mongoose (npm)8.0.0 to before 8.22.18.22.1Patch availableGHSA-wpg9-53fq-2r8h
—mongoose (npm)9.0.0 to before 9.1.69.1.6Patch availableGHSA-wpg9-53fq-2r8h
  • mongoose VendorAutomattic Affected before 6.13.9; 7.0.0 – 7.8.8; 8.0.0 – 8.22.0; 9.0.0 – 9.1.5 Fixed in 6.13.9 Patch available CNA
  • mongoose (npm) Vendor— Affected before 6.13.9 Fixed in 6.13.9 Patch available GHSA-wpg9-53fq-2r8h
  • mongoose (npm) Vendor— Affected 7.0.0 to before 7.8.9 Fixed in 7.8.9 Patch available GHSA-wpg9-53fq-2r8h
  • mongoose (npm) Vendor— Affected 8.0.0 to before 8.22.1 Fixed in 8.22.1 Patch available GHSA-wpg9-53fq-2r8h
  • mongoose (npm) Vendor— Affected 9.0.0 to before 9.1.6 Fixed in 9.1.6 Patch available GHSA-wpg9-53fq-2r8h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*before 6.13.9; 7.0.0 to before 7.8.9; 8.0.0 to before 8.22.1; 9.0.0 to before 9.1.6Vulnerablemongoosejs
  • cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:* Versions before 6.13.9; 7.0.0 to before 7.8.9; 8.0.0 to before 8.22.1; 9.0.0 to before 9.1.6 Vulnerable ·mongoosejs

Remediation

  • Fix · CNA mongoose (Automattic) Fixed in 6.13.9
  • Fix · GHSA-wpg9-53fq-2r8h mongoose (npm) Fixed in 6.13.9 Advisory →
  • Fix · GHSA-wpg9-53fq-2r8h mongoose (npm) Fixed in 7.8.9 Advisory →
  • Fix · GHSA-wpg9-53fq-2r8h mongoose (npm) Fixed in 8.22.1 Advisory →
  • Fix · GHSA-wpg9-53fq-2r8h mongoose (npm) Fixed in 9.1.6 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42334
  2. 2026-10-03 Alias added: GHSA-wpg9-53fq-2r8h

References

Advisory 2

Other 3

  • TI-2023-12700 Improper authentication in WooCommerce Payments WordPress Plugin CVSS 3.1CRITICAL 9.8
  • TI-2023-03453 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
  • TI-2024-06106 Jetpack Boost < 3.4.7 - Admin+ SSRF CVSS 3.1CRITICAL 9.1
  • TI-2013-01782 WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-02368 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
  • TI-2023-02806 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVSS 3.1HIGH 8.8
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences