CVE-2016-10533: Private Data Disclosure in express-restify-mongoose
Summary
CVE-2016-10533: Private Data Disclosure in express-restify-mongoose. Affects express-restify-mongoose across 2 version ranges.
< 2.5.0
>= 3.0.0, < 3.1.0
Fixed in 2.5.0 or 3.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
express-restify-mongoose is an npm package that provides a simple way to create RESTful APIs for mongoose models in Express.js applications. It allows developers to easily expose their mongoose models as RESTful endpoints. However, versions 2.x and 3.x of express-restify-mongoose are vulnerable to an information leakage vulnerability, which may allow an attacker to access fields on a model even if those fields are marked as private.
Vulnerability Detail
The vulnerability in express-restify-mongoose arises from the improper handling of private fields. Normally, developers can mark certain fields as private to prevent them from being exposed in API responses. However, a malicious user can exploit this vulnerability by sending a request for GET /User?distinct=password to retrieve all the passwords for all the users in the database, despite the field being set as private. This vulnerability could potentially be used to access other private data if the attacker knows what fields are set as private for specific routes.
How To Fix
Latest published version: 9.0.13 as of 22 Oct 2026
npm install express-restify-mongoose@9.0.13Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.02.5.0npm install express-restify-mongoose@2.5.0 -
>= 3.0.0, < 3.1.03.1.0npm install express-restify-mongoose@3.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed versions is the recommended solution.
Conclusion
express-restify-mongoose versions 2.x and 3.x are vulnerable to an information leakage vulnerability that allows unauthorized access to private fields. Users should update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for express-restify-mongoose →
FAQ
express-restify-mongoose is an npm package that simplifies the creation of RESTful APIs for mongoose models in Express.js applications.
Versions 2.x and 3.x of express-restify-mongoose are affected.
A malicious user can exploit the vulnerability by sending a request for GET /User?distinct=password to retrieve all the passwords for all the users in the database, despite the field being set as private.
No, there are no known workarounds for this vulnerability. Updating to the fixed versions is the recommended solution.
To fix this vulnerability, users of express-restify-mongoose should update to the following versions:
- Version 2.x: Update to version 2.5.0 or later.
- Version 3.x: Update to version 3.1.0 or later.
