Vulnerability · critical · CVSS 9.8
Mongoose sanitizeFilter not applied on countDocuments (CVE-2026-125120)
Tier A · Patch today – Before you go home
Who’s exposed: Apps on older Mongoose versions passing untrusted input to countDocuments
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Upgrade Mongoose to a patched release that covers your version line, as listed in GHSA-pcrw-h46h-c93h.
The Brief
- In older Mongoose versions, sanitizeFilter was not applied to countDocuments() queries.
- sanitizeFilter is Mongoose's protection against query selector injection, so countDocuments() calls bypassed it.
- Patches have been released for all supported Mongoose versions.
Why it matters
If your application passes user-controlled filters to countDocuments() on an affected version, those filters skipped the query selector injection protection that sanitizeFilter normally provides.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Mongoose is a widely used Node.js MongoDB library that developers build with, so yes. |
| No | Core infrastructure | Mongoose is a single framework-level library, not core infrastructure run by nearly every team. |
| Yes | Popular tool | Mongoose is a mainstream, widely used Node.js ODM with heavy npm download volume. |
| No | Exploited in the wild | GitHub Advisory Database: describes the flaw only; no source reports observed attacks. |
| No | Public exploit | GitHub Advisory Database: advisory text gives no exploit code or proof-of-concept. |
| Yes | Remote, no login | CVSSCVE-2026-125120: CVSS 9.8 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-125120: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | GitHub Advisory Database: no data theft or exposure reported. |
| No | Supply chain | GitHub Advisory Database: a normal bug in legitimate code, not malicious code shipping. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: mongoose fixed in 6.13.11 |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-125120 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mongoose: sanitizeFilter not applied on countDocuments
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 47% of all CVEs
- Fix
- mongoose (npm) fixed in 6.13.11
- mongoose (npm) fixed in 7.8.12
- mongoose (npm) fixed in 8.24.3
- mongoose (npm) fixed in 9.9.2
- Weakness
- CWE-943
Timeline
Advisory GHSA-pcrw-h46h-c93h published in the GitHub Advisory Database
GitHub Advisory Database
Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120)
Source
Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120) ↗ GitHub Advisory Database · 2h ago
First seen · 1 source · Full story page · How tiers are decided