CVE-2022-24304: Mongoose Vulnerable to Prototype Pollution in Schema Object
Summary
CVE-2022-24304: Mongoose Vulnerable to Prototype Pollution in Schema Object. Affects mongoose across 2 version ranges.
< 5.13.15
>= 6.0.0, < 6.4.6
Fixed in 5.13.15 or 6.4.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. It provides a straightforward way to define schemas for MongoDB collections and perform CRUD operations. The package is widely used in Node.js applications for interacting with MongoDB databases.
Vulnerability Detail
The vulnerability in Mongoose is related to prototype pollution in the Schema.path() function. When setting the schema object, an attacker can exploit this vulnerability to modify the Object prototype. This can lead to various types of attacks, including Denial of Service (DoS), Remote Code Execution (RCE), or Property Injection. By manipulating the schema object, an attacker can cause a DoS attack by crashing the application.
How To Fix
Latest published version: 9.11.3 as of 23 Oct 2026
npm install mongoose@9.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.13.155.13.15npm install mongoose@5.13.15 -
>= 6.0.0, < 6.4.66.4.6npm install mongoose@6.4.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a workaround can be implemented by avoiding the use of untrusted data when setting the schema object in Mongoose. It is important to validate and sanitize any user-supplied input before using it in the schema object.
Conclusion
Mongoose is vulnerable to prototype pollution in the Schema.path() function, which can lead to various types of attacks. It is crucial to upgrade to a non-vulnerable version of the package (6.4.6 or 5.13.15) to mitigate this vulnerability. If immediate upgrade is not possible, follow the recommended workaround and ensure proper validation of user input. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mongoose →
FAQ
Mongoose is a MongoDB object modeling tool for Node.js applications.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
This vulnerability in Mongoose can be exploited to perform Denial of Service (DoS) attacks, Remote Code Execution (RCE), or Property Injection.
To fix this vulnerability, upgrade to a non-vulnerable version of the Mongoose package (6.4.6 or 5.13.15).
Yes, if immediate upgrade is not possible, avoid using untrusted data when setting the schema object and ensure proper validation and sanitization of user input.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
