p PatchFirst

CVE-2025-23061

CVE-2025-23061

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

CVSS 9.0 · Critical · EPSS 7.2% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • mongoose

    Versions
    • ≥ 6.0.0, < 6.13.6: Affected (semver)
    • ≥ 7.0.0, < 7.8.4: Affected (semver)
    • ≥ 8.0.0, < 8.9.5: Affected (semver)

    Update to 6.13.6; Update to 7.8.4; Update to 8.9.5

  • mongoose npm

    Affected ranges
    • SEMVER: ≥ 8.0.0-rc0, < 8.9.5

    Update to 8.9.5

  • mongoose npm

    Affected ranges
    • SEMVER: ≥ 7.0.0-rc0, < 7.8.4

    Update to 7.8.4

  • mongoose npm

    Affected ranges
    • SEMVER: < 6.13.6

    Update to 6.13.6

Original sources

Check your server →