Packages / mongoose / Security

CriticalVulnerabilityGHSA-vg7j-7cwx-8wgwBIT-mongoose-2025-23061CVE-2025-23061Published 15 Jan 2025

Mongoose search injection vulnerability

Your version

Affected releases · mongoose

  • 8.x8.0.0 – 8.9.4Fixed in 8.9.5
  • 7.x7.0.0 – 7.8.3Fixed in 7.8.4
  • 6.x6.0.0 – 6.13.5Fixed in 6.13.6
  • 5.x and older0.0.1 – 5.13.23No fix, no longer updated

On 8.x, the newest line:

npm install mongoose@8.9.5
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.11.4

    49 releases, latest

8.x

  1. Affected

    8.0.0 – 8.9.4

    51 releases

  2. Fixed

    8.9.5 – 8.24.7

    58 releases

7.x

  1. Affected

    7.0.0 – 7.8.3

    49 releases

  2. Fixed

    7.8.4 – 7.8.13

    10 releases

6.x

  1. Affected

    6.0.0 – 6.13.5

    115 releases

  2. Fixed

    6.13.6 – 6.13.12

    7 releases

5.x

  1. Affected

    5.0.0 – 5.13.23

    255 releases

4.x

  1. Affected

    4.0.0 – 4.13.21

    164 releases

3.x

  1. Affected

    3.0.0 – 3.9.7

    104 releases

2.x

  1. Affected

    2.0.0 – 2.9.10

    84 releases

1.x

  1. Affected

    1.0.0 – 1.8.4

    64 releases

0.x

  1. Affected

    0.0.1 – 0.0.6

    6 releases

1016 stable releases of mongoose, oldest to newest, one row per major.

What happens

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.