CVE-2023-3696: Mongoose Prototype Pollution vulnerability
Summary
CVE-2023-3696: Mongoose Prototype Pollution vulnerability. Affects mongoose across 3 version ranges.
< 5.13.20
>= 6.0.0, < 6.11.3
>= 7.0.0, < 7.3.3
Fixed in 5.13.20, 6.11.3 or 7.3.3, depending on the release line you run. How to fix ↓
Also tracked for
- mongoose · Bitnami
The same CVE-2023-3696 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongoose is an open-source MongoDB object modeling tool designed to work in an asynchronous environment. It provides a straightforward schema-based solution for modeling application data and includes built-in type casting, validation, query building, and more. Unfortunately, versions prior to 7.3.3, 6.11.3, and 5.13.20 of Mongoose are susceptible to a Prototype Pollution vulnerability.
Vulnerability Detail
The Prototype Pollution vulnerability in Mongoose allows an attacker to modify the prototype of an object, leading to potential remote code execution, denial of service, or information disclosure. This vulnerability arises from improper handling of user-supplied input, allowing malicious actors to inject arbitrary properties into Mongoose's internal prototype, leading to unexpected behavior and security issues.
How To Fix
Latest published version: 9.11.3 as of 23 Oct 2026
npm install mongoose@9.11.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.13.205.13.20npm install mongoose@5.13.20 -
>= 6.0.0, < 6.11.36.11.3npm install mongoose@6.11.3 -
>= 7.0.0, < 7.3.37.3.3npm install mongoose@7.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization to prevent the injection of malicious properties. Additionally, it is recommended to review and validate any user-supplied input before using it in Mongoose's affected functions, such as mongoose.Model.findByIdAndUpdate.
Conclusion
In conclusion, the Mongoose Prototype Pollution vulnerability poses a significant risk to applications utilizing vulnerable versions of Mongoose. It is crucial to update to the fixed versions mentioned above or apply the recommended workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mongoose →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can inject properties into an object's prototype, leading to unexpected behavior and potential security issues.
The consequences of this vulnerability include remote code execution, denial of service, and information disclosure, depending on how the attacker exploits the injected properties.
No, only versions prior to 7.3.3, 6.11.3, and 5.13.20 are affected. It is crucial to update to the fixed versions to mitigate the vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
You can find more information about this vulnerability, including its technical details and affected functions, in the advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-9m93-w8w6-76hh/GHSA-9m93-w8w6-76hh.json
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
