mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 6.1.2 to 6.1.3
1 release in betweenevery note read
Security
7 advisories still affect 6.1.3
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
Upgrading to 6.13.10 clears them.
Release by release
- new
populate: Avoid duplicate model names when using refPath to avoid O(n^2) memory growth with number of array elements #10983
- fixed
schema+model: Cast paths marked with ref when hydrating #11052
- fixed
schema: Handle default function that returns null on document arrays #11058
- fixed
document: Clean modified paths when setting deeply nested subdocument #11060
- new
4 internal lines (docs, tests, tooling) left out.