mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 9.11.4 | Safe from 9.7.2 | |
| 8.24.7 | Safe from 8.24.1 | |
| 7.8.13 | Safe from 7.8.10 | |
| 6.13.12 | Safe from 6.13.10 | |
| 5.13.23 | 39 open advisories, worst critical · last release Dec 2024, no longer updated |
- CriticalMongoose search injection vulnerabilityGHSA-vg7j-7cwx-8wgw · 15 Jan 2025fixed in 8.9.5, 7.8.4, 6.13.6
- CriticalMongoose Prototype Pollution vulnerabilityGHSA-9m93-w8w6-76hh · 17 Jul 2023fixed in 7.3.3, 6.11.3, 5.13.20
- CriticalMongoose Vulnerable to Prototype Pollution in Schema ObjectGHSA-h8hf-x3f4-xwgp · 27 Aug 2022fixed in 6.4.6, 5.13.15
- CriticalImproper Input Validation in Automattic MongooseGHSA-8687-vv9j-hgph · 22 Oct 2019fixed in 5.7.5, 4.13.21
- HighMongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionGHSA-wpg9-53fq-2r8h · 5 May 2026fixed in 9.1.6, 8.22.1, 7.8.9 +1
- HighMongoose search injection vulnerabilityGHSA-m7xq-9374-9rvx · 2 Dec 2024fixed in 8.8.3, 7.8.3, 6.13.5 +1
- Highautomattic/mongoose vulnerable to Prototype pollution via Schema.pathGHSA-f825-f98c-gj3g · 29 Jul 2022fixed in 6.4.6, 5.13.15
- ModerateMongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)GHSA-664h-wqgq-64gw · 24 Jul 2026fixed in 9.7.2, 8.24.1, 7.8.10 +1
- ModerateRemote Memory Exposure in mongooseGHSA-r5xw-q988-826m · 1 Sep 2020fixed in 4.3.6, 3.8.39
Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.