npm package
mongoose vulnerabilities by version
The latest release, 9.11.2 (Oct 12, 2026), has no known vulnerabilities. 45% of last week’s 6.8M downloads went to versions with known vulnerabilities. OSV.dev lists 9 advisories for mongoose; the newest was published on Jul 24, 2026.
npm (opens in a new tab) describes it as “Mongoose MongoDB ODM”
- Latest release
- 9.11.2
- Oct 12, 2026, no known vulnerabilities
- Downloads last week
- 6.8M
- All versions, from npm
- Advisories on OSV.dev
- 9
- Newest Jul 24, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable mongoose
45% of last week’s 6.8M mongoose downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. mongoose doesn’t publish support dates we can check.
Newest advisories
The 5 most recently published, with the versions each one affects.
WarningCVE-2026-73562 on OSV.dev (opens in a new tab)GHSA-664h-wqgq-64gw
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Affects < 6.13.10; >= 7.0.0, < 7.8.10; >= 8.0.0, < 8.24.1; >= 9.0.0, < 9.7.2. Published Jul 24, 2026.
CriticalCVE-2026-42334 on OSV.dev (opens in a new tab)GHSA-wpg9-53fq-2r8h
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Affects < 6.13.9; >= 7.0.0, < 7.8.9; >= 8.0.0, < 8.22.1; >= 9.0.0, < 9.1.6. Published May 5, 2026.
CriticalCVE-2025-23061 on OSV.dev (opens in a new tab)GHSA-vg7j-7cwx-8wgw
Mongoose search injection vulnerability
Affects >= 8.0.0-rc0, < 8.9.5; >= 7.0.0-rc0, < 7.8.4; < 6.13.6. Published Jan 15, 2025.
CriticalCVE-2024-53900 on OSV.dev (opens in a new tab)GHSA-m7xq-9374-9rvx
Mongoose search injection vulnerability
Affects >= 8.0.0-rc0, < 8.8.3; >= 7.0.0-rc0, < 7.8.3; >= 6.0.0-rc0, < 6.13.5; >= 3.6.0-rc0, < 5.13.23. Published Dec 2, 2024.
CriticalCVE-2023-3696 on OSV.dev (opens in a new tab)GHSA-9m93-w8w6-76hh
Mongoose Prototype Pollution vulnerability
Affects >= 7.0.0, < 7.3.3; >= 6.0.0, < 6.11.3; < 5.13.20. Published Jul 17, 2023.
All 9 advisories are on OSV.dev (opens in a new tab).
Which mongoose do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for mongoose, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.