CVE-2026-125120

Mongoose: sanitizeFilter not applied on countDocuments

mongoose, mongoose, mongoose

### Impact `sanitizeFilter` is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, `sanitizeFilter` was not applied for `countDocuments()` queries. ### Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using. 1. `^9.9.2` 2. `^8.24.3` 3. `^7.8.12` 4. `^6.13.11` ### Workarounds…

10. Nov 2026

Ausgewertete Quellen

• GitHub
  GHSA-pcrw-h46h-c93h