Packages / mongoose / Security

CriticalVulnerabilityGHSA-9m93-w8w6-76hhBIT-mongoose-2023-3696CVE-2023-3696Published 17 Jul 2023

Mongoose Prototype Pollution vulnerability

Your version

Affected releases · mongoose

  • 7.x7.0.0 – 7.3.2Fixed in 7.3.3
  • 6.x6.0.0 – 6.11.2Fixed in 6.11.3
  • 5.x5.0.0 – 5.13.19Fixed in 5.13.20
  • 4.x and older0.0.1 – 4.13.21No fix, no longer updated

On 7.x, the newest line:

npm install mongoose@7.3.3
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.11.4

    49 releases, latest

7.x

  1. Affected

    7.0.0 – 7.3.2

    17 releases

  2. Fixed

    7.3.3 – 7.8.13

    42 releases

6.x

  1. Affected

    6.0.0 – 6.11.2

    95 releases

  2. Fixed

    6.11.3 – 6.13.12

    27 releases

5.x

  1. Affected

    5.0.0 – 5.13.19

    251 releases

  2. Fixed

    5.13.20 – 5.13.23

    4 releases

4.x

  1. Affected

    4.0.0 – 4.13.21

    164 releases

3.x

  1. Affected

    3.0.0 – 3.9.7

    104 releases

2.x

  1. Affected

    2.0.0 – 2.9.10

    84 releases

1.x

  1. Affected

    1.0.0 – 1.8.4

    64 releases

0.x

  1. Affected

    0.0.1 – 0.0.6

    6 releases

1016 stable releases of mongoose, oldest to newest, one row per major.

What happens

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.