mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 4.11.9 to 9.11.4
628 releases in betweennotes for 12
Counted from 12 of 628 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated6.8.0
Security
Fixes 8 advisories affecting 4.11.9
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
- Mongoose Vulnerable to Prototype Pollution in Schema Objectcritical · GHSA-h8hf-x3f4-xwgp
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h
Release by release
6.13.10 – 9.11.4220 releases, no release note
- new
types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299
- fixed
Handle other top-level query operators in sanitizeFilter
- new
6.13.7 – 6.13.82 releases, nothing new or fixed in the notes
- fixed
Disallow nested $where in populate match
- fixed
6.10.1 – 6.13.528 releases, no release note
- new
Upgrade to mongodb driver 4.14.0 #13036
- new
Added Schema.prototype.omit() function #12939 #12931 lpizzinidev
- new
index: Added createInitialConnection option to Mongoose constructor #13021 #12965 lpizzinidev
- new
6.9.1 – 6.9.33 releases, no release note
- new
schema: Add removeVirtual(path) function to schema #12920 IslandRhythms
- fixed
cast: Remove empty
$orconditions after strict applied #12898 0x0a0d
- new
6 internal lines (docs, tests, tooling) left out.