# Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-pcrw-h46h-c93h) · 2026-11-10 · Security
Page: https://themorning.dev/story/mongoose-sanitizefilter-not-applied-on-countdocuments-cve-2026-125120-685ec437d83395bc
Kind: security · Impact: medium

## In brief

- In older Mongoose versions, sanitizeFilter was not applied to countDocuments() queries.
- sanitizeFilter is Mongoose's protection against query selector injection, so countDocuments() calls bypassed it.
- Patches have been released for all supported Mongoose versions.

## Why it matters

If your application passes user-controlled filters to countDocuments() on an affected version, those filters skipped the query selector injection protection that sanitizeFilter normally provides.

## What to do

- Upgrade Mongoose to a patched release that covers your version line, as listed in GHSA-pcrw-h46h-c93h.

## CVEs

- CVE-2026-125120

## Timeline

- 2026-11-10: Advisory GHSA-pcrw-h46h-c93h published in the GitHub Advisory Database

## Coverage

- [Mongoose: sanitizeFilter not applied on countDocuments (CVE-2026-125120)](https://github.com/advisories/GHSA-pcrw-h46h-c93h) — GitHub Advisory Database, 2026-11-10

Tags: mongoose, mongodb, security, nosql-injection, nodejs, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev