Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Automattic | mongoose | before 6.13.10; 7.0.0 to before 7.8.10; 8.0.0 to before 8.24.1; 9.0.0 to before 9.7.2 | 6.13.10, 7.8.10, 8.24.1, 9.7.2 | Patch available | CNA |
| — | mongoose (npm) | before 6.13.10 | 6.13.10 | Patch available | GHSA-664h-wqgq-64gw |
| — | mongoose (npm) | 7.0.0 to before 7.8.10 | 7.8.10 | Patch available | GHSA-664h-wqgq-64gw |
| — | mongoose (npm) | 8.0.0 to before 8.24.1 | 8.24.1 | Patch available | GHSA-664h-wqgq-64gw |
| — | mongoose (npm) | 9.0.0 to before 9.7.2 | 9.7.2 | Patch available | GHSA-664h-wqgq-64gw |
- mongoose VendorAutomattic Affected before 6.13.10; 7.0.0 to before 7.8.10; 8.0.0 to before 8.24.1; 9.0.0 to before 9.7.2 Fixed in 6.13.10, 7.8.10, 8.24.1, 9.7.2 Patch available CNA
- mongoose (npm) Vendor— Affected before 6.13.10 Fixed in 6.13.10 Patch available GHSA-664h-wqgq-64gw
- mongoose (npm) Vendor— Affected 7.0.0 to before 7.8.10 Fixed in 7.8.10 Patch available GHSA-664h-wqgq-64gw
- mongoose (npm) Vendor— Affected 8.0.0 to before 8.24.1 Fixed in 8.24.1 Patch available GHSA-664h-wqgq-64gw
- mongoose (npm) Vendor— Affected 9.0.0 to before 9.7.2 Fixed in 9.7.2 Patch available GHSA-664h-wqgq-64gw
Remediation
- Fix · CNA mongoose (Automattic) Fixed in 6.13.10, 7.8.10, 8.24.1, 9.7.2
- Fix · GHSA-664h-wqgq-64gw mongoose (npm) Fixed in 6.13.10 Advisory →
- Fix · GHSA-664h-wqgq-64gw mongoose (npm) Fixed in 7.8.10 Advisory →
- Fix · GHSA-664h-wqgq-64gw mongoose (npm) Fixed in 8.24.1 Advisory →
- Fix · GHSA-664h-wqgq-64gw mongoose (npm) Fixed in 9.7.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73562
- 2026-10-03 Alias added: GHSA-664h-wqgq-64gw
References
Other 12
- https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
- https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f
- https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a
- https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45
- https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740
- https://github.com/Automattic/mongoose/pull/16230
- https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b
- https://github.com/Automattic/mongoose
- https://github.com/Automattic/mongoose/releases/tag/6.13.10
- https://github.com/Automattic/mongoose/releases/tag/7.8.10
- https://github.com/Automattic/mongoose/releases/tag/8.24.1
- https://github.com/Automattic/mongoose/releases/tag/9.7.2
More Automattic vulnerabilities
- TI-2023-12700 Improper authentication in WooCommerce Payments WordPress Plugin CVSS 3.1CRITICAL 9.8
- TI-2023-03453 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
- TI-2024-06106 Jetpack Boost < 3.4.7 - Admin+ SSRF CVSS 3.1CRITICAL 9.1
- TI-2013-01782 WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-02368 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
- TI-2023-02806 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVSS 3.1HIGH 8.8
Sources
- CVE-2026-73562 · CVE Program
- CVE-2026-73562 · NVD
- FIRST EPSS
- GHSA-664h-wqgq-64gw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences