mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 3.8.4 to 6.13.10
582 releases in betweennotes for 75
Counted from 75 of 582 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking6.0.12
- deprecated6.8.0
Security
Fixes 9 advisories affecting 3.8.4
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
- Mongoose Vulnerable to Prototype Pollution in Schema Objectcritical · GHSA-h8hf-x3f4-xwgp
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Remote Memory Exposure in mongoosemoderate · GHSA-r5xw-q988-826m
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h
Release by release
6.13.10no release note
- new
types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299
- fixed
Handle other top-level query operators in sanitizeFilter
- new
6.13.7 – 6.13.82 releases, nothing new or fixed in the notes
- fixed
Disallow nested $where in populate match
- fixed
6.10.2 – 6.13.527 releases, no release note
- fixed
Avoid removing empty query filters in
$andand$or#13086 #12898 - fixed
schematype: Fixed validation for required UUID field #13018 lpizzinidev
- fixed
types: Add missing Paths generic param to
Model.populate()#13070
- fixed
- new
Upgrade to mongodb driver 4.14.0 #13036
- new
Added Schema.prototype.omit() function #12939 #12931 lpizzinidev
- new
index: Added createInitialConnection option to Mongoose constructor #13021 #12965 lpizzinidev
- new
- fixed
connection: Delay calculating
autoCreateandautoIndexuntil after initial connection established #13007 #12940 lpizzinidev - fixed
discriminator: Allows update doc with discriminatorKey #13056 #13055 abarriel
- fixed
query: Avoid sending unnecessary empty projection to MongoDB server #13059 #13050
- fixed
model: Avoid sending null session option with document operations #13053 #13052 lpizzinidev
- fixed
types: Use MergeTypes for type overrides in HydratedDocument #13066 #13040
- fixed
173 internal lines (docs, tests, tooling) left out.