mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Your version
3.8.39
15 Jan 20163.9.7 is the newest release of 3.x.
Security
Fixes 1 advisory that affected 3.8.38
- ModerateRemote Memory Exposure in mongooseGHSA-r5xw-q988-826m · 1 Sep 2020Fixed in 3.8.39
8 advisories affect 3.8.39; 6.13.10 fixes them
- CriticalMongoose search injection vulnerabilityGHSA-vg7j-7cwx-8wgw · 15 Jan 2025Fixed in 6.13.6
- CriticalMongoose Prototype Pollution vulnerabilityGHSA-9m93-w8w6-76hh · 17 Jul 2023Fixed in 5.13.20
- CriticalMongoose Vulnerable to Prototype Pollution in Schema ObjectGHSA-h8hf-x3f4-xwgp · 27 Aug 2022Fixed in 5.13.15
- CriticalImproper Input Validation in Automattic MongooseGHSA-8687-vv9j-hgph · 22 Oct 2019Fixed in 4.13.21
- HighMongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionGHSA-wpg9-53fq-2r8h · 5 May 2026Fixed in 6.13.9
3 more
- HighMongoose search injection vulnerabilityGHSA-m7xq-9374-9rvx · 2 Dec 2024Fixed in 5.13.23
- Highautomattic/mongoose vulnerable to Prototype pollution via Schema.pathGHSA-f825-f98c-gj3g · 29 Jul 2022Fixed in 5.13.15
- ModerateMongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)GHSA-664h-wqgq-64gw · 24 Jul 2026Fixed in 6.13.10
Release note
No note was found for 3.8.39 on GitHub or in the repository's changelog.