CVE-2025-23061: Mongoose Search Injection Vulnerability
Summary
CVE-2025-23061: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. Affects mongoose across 3 version ranges.
>= 6.0.0, < 6.13.6
>= 7.0.0, < 7.8.4
>= 8.0.0, < 8.9.5
Fixed in 6.13.6, 7.8.4 or 8.9.5, depending on the release line you run. How to fix ↓
Also tracked for
- mongoose · npm
The same CVE-2025-23061 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mongoose is a popular Object Data Modeling (ODM) library for Node.js, designed to work with MongoDB. It provides a straightforward way to model application data, offering features like schema validation, query building, and middleware support. However, Mongoose versions prior to 8.9.5 are susceptible to a critical vulnerability that can lead to search injection attacks when using nested $where filters with the populate() method.
Vulnerability Detail
The vulnerability arises from an improper handling of nested $where filters in Mongoose, particularly when combined with the populate() method. This flaw can allow attackers to manipulate queries, potentially leading to unauthorized data access or data leakage. The issue is exacerbated by an incomplete fix for a previous vulnerability (CVE-2024-53900), which highlights the importance of thorough testing and validation in software updates.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.13.66.13.6 -
>= 7.0.0, < 7.8.47.8.4 -
>= 8.0.0, < 8.9.58.9.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid using nested $where filters with the populate() method until you can upgrade to a secure version. Review your queries to ensure they do not expose sensitive data.
Conclusion
In summary, CVE-2025-23061 poses a significant risk to applications using Mongoose versions prior to 8.9.5. It is crucial to update to the latest version to mitigate this vulnerability and ensure the security of your application.
See every vulnerability recorded for mongoose →
FAQ
CVE-2025-23061 is a critical vulnerability in Mongoose that allows for search injection through improper use of nested $where filters.
Mongoose versions prior to 8.9.5, including 6.x and 7.x versions, are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, potentially compromising the integrity and confidentiality of your application.
Regularly update your dependencies, conduct security audits, and use tools like Vulert to monitor for vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
