mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 5.3.6 to 9.11.4
540 releases in betweennotes for 0
9.0.0, 8.0.0, 7.0.0, 6.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
- ?
- changes to make
- 8
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 0 of 540 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 8 advisories affecting 5.3.6
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Improper Input Validation in Automattic Mongoosecritical · GHSA-8687-vv9j-hgph
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
- Mongoose Vulnerable to Prototype Pollution in Schema Objectcritical · GHSA-h8hf-x3f4-xwgp
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h