mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 3.6.1 to 3.9.7
72 releases in betweennotes for 1
- ?
- changes to make
- 1
- advisory fixed
- ?
- new
- 2+
- fixes
Counted from 1 of 72 release notes. Advisories are counted from the advisory database, in full.
Security
8 advisories still affect 3.9.7
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
Upgrading to 6.13.10 clears them.
Fixes 1 advisory affecting 3.6.1
- Remote Memory Exposure in mongoosemoderate · GHSA-r5xw-q988-826m
Release by release
3.6.14 – 3.9.760 releases, no release note
- fixed
Fixed; calling model.distinct without conditions #1541
- fixed
Fixed; regression in Query#count() #1542
- fixed
3.6.2 – 3.6.1211 releases, no release note