CVE-2026-125117

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

• CWE-1321

• https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50
• https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee
• https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8
• https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82
• https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b
• https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74
• https://github.com/Automattic/mongoose/releases/tag/6.13.12
• https://github.com/Automattic/mongoose/releases/tag/7.8.13
• https://github.com/Automattic/mongoose/releases/tag/8.24.7
• https://github.com/Automattic/mongoose/releases/tag/9.11.4
• https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4
• https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125103FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125104FFmpeg through 9.0.2 contains a memory exhaustion vulnerabil…5.5
• CVE-2026-125107Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-125122compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125123compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125124compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125125compose-lint is a Docker Compose security linter that identi…2.3