CVE-2025-23061: Mongoose Search Injection Vulnerability
Summary
CVE-2025-23061: Mongoose search injection vulnerability. Affects mongoose across 3 version ranges.
< 6.13.6
>= 7.0.0-rc0, < 7.8.4
>= 8.0.0-rc0, < 8.9.5
Fixed in 6.13.6, 7.8.4 or 8.9.5, depending on the release line you run. How to fix ↓
Also tracked for
- mongoose · Bitnami
The same CVE-2025-23061 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongoose is a popular Object Data Modeling (ODM) library for MongoDB and Node.js, providing a straightforward way to interact with MongoDB databases. It offers features such as schema validation, query building, and middleware support. However, Mongoose versions prior to 8.9.5 are vulnerable to a search injection issue due to improper handling of nested $where filters in conjunction with populate() matches, which can lead to unintended data exposure or manipulation.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous issue (CVE-2024-53900), allowing attackers to exploit the $where filter in Mongoose queries. This can lead to search injection attacks, where malicious users can manipulate queries to retrieve or modify data in ways not intended by the application. The severity of this vulnerability is rated as critical, with a CVSS score of 9.0, indicating a high potential for impact on affected systems.
How To Fix
Latest published version: 9.11.3 as of 23 Oct 2026
npm install mongoose@9.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.13.66.13.6npm install mongoose@6.13.6 -
>= 7.0.0-rc0, < 7.8.47.8.4npm install mongoose@7.8.4 -
>= 8.0.0-rc0, < 8.9.58.9.5npm install mongoose@8.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to the patched version immediately, consider avoiding the use of nested $where filters in your queries or implementing additional validation and sanitization on user inputs to mitigate the risk of injection attacks.
Conclusion
The Mongoose search injection vulnerability (CVE-2025-23061) poses a significant risk to applications using affected versions of the library. It is crucial to update to version 8.9.5 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in your dependencies.
See every vulnerability recorded for mongoose →
FAQ
The vulnerability allows for search injection through improper handling of nested $where filters in Mongoose queries.
If you are using Mongoose versions prior to 8.9.5, your application may be vulnerable. You can check your package-lock.json file or use the Vulert playground to assess your application's exposure.
Exploitation of this vulnerability can lead to unauthorized data access, data manipulation, or even complete compromise of the application.
Yes, you can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time without requiring code access or installation.
Implement workarounds such as avoiding nested $where filters and enhancing input validation to reduce the risk of injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
