Detections
Analytics
CVE-2025-23061
critical
Description
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
References
https://www.securityweek.com/vulnerabilities-in-mongodb-library-allow-rce-on-node-js-servers/
https://www.theregister.com/2025/02/20/mongoose_flaws_mongodb/
https://github.com/Farenhytee/database-sentinel
https://github.com/dajneem23/CVE-2025-23061
https://github.com/NamhyeonKo/mongoose-cve-lab
https://github.com/advisories/GHSA-vg7j-7cwx-8wgw
https://www.npmjs.com/package/mongoose?activeTab=versions
https://github.com/Automattic/mongoose/releases/tag/8.9.5
https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md