mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 6.2.6 to 6.2.7
1 release in betweenevery note read
Security
7 advisories still affect 6.2.7
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- automattic/mongoose vulnerable to Prototype pollution via Schema.pathhigh · GHSA-f825-f98c-gj3g
Upgrading to 6.13.10 clears them.
Release by release
- new
document: Avoid running validation on every array element if there's no validators to run #11380
- fixed
cursor: Correctly populate in batches when batchSize is set #11509
- fixed
connection: Avoid setting MongoClient on useDb() connections until after setting on base connection #11445
- fixed
schema: Throw more helpful error when using schema from a different version of Mongoose module #10453
- fixed
Add missing timeseries expiration handling #11489 #11229 Uzlopak
- new
1 internal line (docs, tests, tooling) left out.