CVE-2026-125116
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Executive briefing
A structured intelligence assessment has not yet been generated. The source description is shown above. The background enrichment worker will retry this record.
Evidence confidence: Not assessed Evidence-derived, not an exploitability verdict
Severity & attack characteristics
CVSS vector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Technical explanation & impact
Technical root-cause details are not available in the current source record.
Assess the impact using the published CVSS metrics and the affected vendor component.
Affected products and versions
NVD has not supplied machine-readable vulnerable CPE product/version entries for this CVE. This is an information gap, not proof that no products are affected. Check the vendor advisory references below.
Remediation & validation
- Identify exposure by comparing the affected product and version ranges with your asset inventory, SBOM and externally exposed services.
- Review the linked vendor security advisory or patch notes. Upgrade to a vendor-confirmed fixed release; do not infer a fixed version from the CVE description.
- Until patched, consider restricting network access or disabling the affected feature where operationally safe. These are temporary controls, not a substitute for a vendor fix.
- Validate the remediation with a version check and vulnerability rescan, then retain change evidence.
No fixed version is displayed unless it is explicitly established by a vendor advisory. Follow the vendor's release notes for exact product and branch applicability.
Vendor advisories, patches & exploit references
- https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/releases/tag/6.13.12 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/releases/tag/7.8.13 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/releases/tag/8.24.7 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/releases/tag/9.11.4 VENDOR security-advisories@github.com
- https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96 VENDOR security-advisories@github.com