Packages / mongoose / Security

HighVulnerabilityGHSA-f825-f98c-gj3gBIT-mongoose-2022-2564CVE-2022-2564Published 29 Jul 2022

automattic/mongoose vulnerable to Prototype pollution via Schema.path

Your version

Affected releases · mongoose

  • 6.x6.0.0 – 6.4.5Fixed in 6.4.6
  • 5.x5.0.0 – 5.13.14Fixed in 5.13.15
  • 4.x and older0.0.1 – 4.13.21No fix, no longer updated

On 6.x, the newest line:

npm install mongoose@6.4.6
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.11.4

    49 releases, latest

6.x

  1. Affected

    6.0.0 – 6.4.5

    55 releases

  2. Fixed

    6.4.6 – 6.13.12

    67 releases

5.x

  1. Affected

    5.0.0 – 5.13.14

    246 releases

  2. Fixed

    5.13.15 – 5.13.23

    9 releases

4.x

  1. Affected

    4.0.0 – 4.13.21

    164 releases

3.x

  1. Affected

    3.0.0 – 3.9.7

    104 releases

2.x

  1. Affected

    2.0.0 – 2.9.10

    84 releases

1.x

  1. Affected

    1.0.0 – 1.8.4

    64 releases

0.x

  1. Affected

    0.0.1 – 0.0.6

    6 releases

1016 stable releases of mongoose, oldest to newest, one row per major.

What happens

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.