mongoose
9.11.4 · 23 Oct 2026MIT5.8M / weekRepositoryHomepagenpmAtom feed
Upgrading mongoose from 6.7.2 to 6.13.12
48 releases in betweennotes for 19
Counted from 19 of 48 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated6.8.0
Security
Fixes 5 advisories affecting 6.7.2
- Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)moderate · GHSA-664h-wqgq-64gw
- Mongoose Prototype Pollution vulnerabilitycritical · GHSA-9m93-w8w6-76hh
- Mongoose search injection vulnerabilityhigh · GHSA-m7xq-9374-9rvx
- Mongoose search injection vulnerabilitycritical · GHSA-vg7j-7cwx-8wgw
- Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injectionhigh · GHSA-wpg9-53fq-2r8h
Release by release
6.13.12no release note
- fixed
query: Apply sanitizeFilter in countDocuments and cursor
- fixed
6.13.10no release note
- new
types(aggregate): add $firstN, $lastN, $bottom, $bottomN, $minN and $maxN operators #15303 #15299
- fixed
Handle other top-level query operators in sanitizeFilter
- new
6.13.7 – 6.13.82 releases, nothing new or fixed in the notes
- fixed
Disallow nested $where in populate match
- fixed
6.10.2 – 6.13.527 releases, no release note
- fixed
Avoid removing empty query filters in
$andand$or#13086 #12898 - fixed
schematype: Fixed validation for required UUID field #13018 lpizzinidev
- fixed
types: Add missing Paths generic param to
Model.populate()#13070
- fixed
43 internal lines (docs, tests, tooling) left out.