CVE-2024-53900: Mongoose Search Injection Vulnerability
Summary
CVE-2024-53900: Mongoose search injection vulnerability. Affects mongoose across 3 version ranges.
< 6.13.5
>= 7.0.0-rc0, < 7.8.3
>= 8.0.0-rc0, < 8.8.3
Fixed in 6.13.5, 7.8.3 or 8.8.3, depending on the release line you run. How to fix ↓
Also tracked for
- mongoose · Bitnami
The same CVE-2024-53900 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongoose is a popular Object Data Modeling (ODM) library for MongoDB and Node.js, providing a straightforward way to model application data. It offers features such as schema validation, query building, and middleware support, making it a vital tool for developers working with MongoDB. However, prior to version 8.8.3, Mongoose had a vulnerability that could lead to search injection attacks due to improper use of the $where operator in match queries.
Vulnerability Detail
The vulnerability arises from Mongoose's handling of the $where operator in match queries, which can be exploited to perform search injection attacks. This occurs when user input is improperly sanitized, allowing attackers to execute arbitrary JavaScript code on the database. The ramifications of this vulnerability include unauthorized data access, data manipulation, and potential compromise of the entire database. It is crucial for developers to understand the implications of using the $where operator and ensure that user inputs are properly validated and sanitized.
How To Fix
Latest published version: 9.11.3 as of 23 Oct 2026
npm install mongoose@9.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.13.56.13.5npm install mongoose@6.13.5 -
>= 7.0.0-rc0, < 7.8.37.8.3npm install mongoose@7.8.3 -
>= 8.0.0-rc0, < 8.8.38.8.3npm install mongoose@8.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the $where operator in your queries. Instead, use standard query operators that do not execute arbitrary JavaScript. For example, replace queries like this:
Model.find({ $where: 'this.name === userInput' })
with safer alternatives:
Model.find({ name: userInput })
This approach minimizes the risk of injection attacks until you can update to the patched version.
Conclusion
The Mongoose search injection vulnerability (CVE-2024-53900) poses significant risks to applications using versions prior to 8.8.3. It is essential to update to the latest version to protect against potential attacks. Additionally, employing safer coding practices and utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for mongoose →
FAQ
CVE-2024-53900 is a vulnerability in Mongoose that allows for search injection attacks due to improper handling of the $where operator in match queries.
If you are using Mongoose versions prior to 8.8.3, your application may be vulnerable. You can check your package-lock.json file or use Vulert to monitor for vulnerabilities.
The risks include unauthorized access to data, data manipulation, and potential compromise of the database, which could lead to significant security breaches.
Yes, you can use Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring code access or installation.
If you cannot update immediately, avoid using the $where operator in your queries and use safer alternatives to mitigate the risk of injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
