CVE-2026-125119

Mongoose: Connection-level sanitizeFilter not applied

mongoose, mongoose, mongoose

### Summary sanitizeFilter exists to stop query selector injection: it wraps operator objects such as `{ $ne: null }` in filter values in `$eq`, so they are matched literally. Set on a connection with `mongoose.connect()` or `createConnection(uri, { sanitizeFilter: true })`, the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to…

10. Nov 2026

Ausgewertete Quellen

• GitHub
  GHSA-gg4r-jv3p-qx3c