JEDI-SEC | Security Research & Digital Defense

GHSA-pcrw-h46h-c93h: Mongoose: sanitizeFilter not applied on countDocuments

Written by

jedisec_u136k7

in

  • Severity: CRITICAL
  • CVE: CVE-2026-125120
  • Ecosystems: npm, npm, npm, npm
  • Packages: mongoose, mongoose, mongoose, mongoose

### Impact

`sanitizeFilter` is Mongoose’s mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanitizeFilter` was not applied for `countDocuments()` queries.

### Patches

Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using.

1. `^9.9.2`
2. `^8.24.3`
3. `^7.8.12`
4. `^6.13.11`

### Workarounds

Middleware:

“`javascript
mongoose.plugin(function() {
schema.pre(‘countDocuments’, function() {
// This will always apply `sanitizeFilter` on `countDocuments`
mongoose.sanitizeFilter(this.getFilter());
});
});
“`

Source: GitHub Security Advisories · 2026-11-10

More posts