SecurityFan score 65 · Tier A
Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120)
The Brief
- In older Mongoose versions, sanitizeFilter was not applied to countDocuments() queries.
- sanitizeFilter is Mongoose's protection against query selector injection, so countDocuments() calls bypassed it.
- Patches have been released for all supported Mongoose versions.
Why it matters
If your application passes user-controlled filters to countDocuments() on an affected version, those filters skipped the query selector injection protection that sanitizeFilter normally provides.
Who’s affected
- Teams running older Mongoose versions that use countDocuments() with untrusted filter input
What to do
- Upgrade Mongoose to a patched release that covers your version line, as listed in GHSA-pcrw-h46h-c93h.
Affects mongoose. Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries. Patches Patches have been released for all supported Mongoose…
Timeline
Advisory GHSA-pcrw-h46h-c93h published in the GitHub Advisory Database
GitHub Advisory Database
Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120)