mongoosejs güvenlik açıkları (CVE)

mongoosejs için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

2 sonuç

7.5Yüksek

CVE-2026-42334 6 ay önce

Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Automattic mongoose

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitize…

9.0Kritik

CVE-2025-23061 1 yıl önce

mongoosejs Mongoose

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

7.2%EPSS