fix(deps): update dependency mongoose to v7.8.10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	7.6.5 → 7.8.10

---

Mongoose search injection vulnerability

CVE-2024-53900 / GHSA-m7xq-9374-9rvx

More information

Details

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-53900
• https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156
• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
• https://github.com/Automattic/mongoose/releases
• https://www.npmjs.com/package/mongoose?activeTab=versions
• https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b
• https://github.com/Automattic/mongoose/compare/6.13.4...6.13.5
• https://github.com/Automattic/mongoose/compare/7.8.2...7.8.3
• https://github.com/Automattic/mongoose/compare/8.8.2...8.8.3
• https://github.com/github/advisory-database/pull/6769
• https://github.com/github/advisory-database/pull/6776
• https://github.com/Automattic/mongoose/commit/bbb6fa7ecb44bbaf5bea955d886378a1247bce0b
• https://github.com/advisories/GHSA-m7xq-9374-9rvx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mongoose search injection vulnerability

CVE-2025-23061 / GHSA-vg7j-7cwx-8wgw

More information

Details

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-23061
• https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
• https://github.com/Automattic/mongoose/releases/tag/8.9.5
• https://www.npmjs.com/package/mongoose?activeTab=versions
• https://github.com/Automattic/mongoose/compare/6.13.5...6.13.6
• https://github.com/Automattic/mongoose/compare/7.8.3...7.8.4
• https://github.com/Automattic/mongoose/compare/8.9.4...8.9.5
• https://github.com/Automattic/mongoose/releases/tag/6.13.6
• https://github.com/Automattic/mongoose/releases/tag/7.8.4
• https://github.com/advisories/GHSA-m7xq-9374-9rvx
• https://github.com/advisories/GHSA-vg7j-7cwx-8wgw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

CVE-2026-42334 / GHSA-wpg9-53fq-2r8h

More information

Details

Impact

This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator.

When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized.

This may lead to:

• Authentication bypass
• Unauthorized data access
• Data exfiltration

Affected users:

Applications that:

• Explicitly enable sanitizeFilter
• Pass unsanitized user-controlled input directly into query methods (e.g., Model.findOne(req.body)) and rely on sanitizeFilter to strip out query selectors

Applications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, Model.findOne({ user: req.body.user, pwd: req.body.pwd }) is not affected.

Patches

Patches have been released for all supported Mongoose release lines:

• ^6.13.9
• ^7.8.9
• ^8.22.1
• ^9.1.6

Workarounds

Delete $nor keys, use an additional schema validation library, or write middleware to strip out $nor from query filters.

Resources

sanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()

Original blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h
• https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()
• https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-42334
• https://github.com/advisories/GHSA-wpg9-53fq-2r8h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mongoose: Prototype pollution in mongoose update casting via proto-prefixed dotted path (Schema._getSchema/path getter)

CVE-2026-73562 / GHSA-664h-wqgq-64gw

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype.

Example:

const mongoose = require('mongoose');
console.log('before:', Object.prototype.$fullPath);            // undefined

const User = mongoose.model('User', new mongoose.Schema({ name: String }));
const malicious = JSON.parse('{"$set": {"__proto__.x": "anything"}}');   // attacker-controlled update

const q = User.updateOne({}, {});
try { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }

console.log('after :', Object.prototype.$fullPath);            // "__proto__"
console.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath'));  // true
console.log('fresh {}:', ({}).$fullPath);                      // "__proto__"

Patches

Has the problem been patched? What versions should users upgrade to?

9.7.2, 8.24.1. 7.8.10, 6.13.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Check user-controlled updates for own __proto__ properties before passing to Mongoose

References

Are there any links users can visit to find out more?

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

• https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
• https://github.com/Automattic/mongoose/pull/16230
• https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b
• https://github.com/Automattic/mongoose/releases/tag/6.13.10
• https://github.com/Automattic/mongoose/releases/tag/7.8.10
• https://github.com/Automattic/mongoose/releases/tag/8.24.1
• https://github.com/Automattic/mongoose/releases/tag/9.7.2
• https://github.com/advisories/GHSA-664h-wqgq-64gw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

Automattic/mongoose (mongoose)

v7.8.10

Compare Source

7.8.10 / 2026-06-22

• fix(document): add additional defensive checks for special properties in Document.prototype.get()
• fix(schema): avoid returning inherited properties from schema path lookups
• docs(schema): add instanceof/typeof checks to default getter examples for populated docs and nullish values #​16272 #​16250

v7.8.9

Compare Source

==================

• fix: handle other top-level query operators in sanitizeFilter

v7.8.8

Compare Source

==================

• fix(bulkWrite): pass overwriteImmutable option to castUpdate fixes #​15789 #​15782 #​15781
• fix(model): bump version if necessary after successful bulkSave() #​15800

v7.8.7

Compare Source

==================

• types(aggregate): allow calling project() with a string #​15304 #​15300
• docs: update deleteOne & deleteMany API def #​15360 Elliot67 SethFalco

v7.8.6

Compare Source

===================

• chore: remove coverage output from bundle

v7.8.5

Compare Source

===================

• chore: re-release to force npm audit to pick up 6.x fix for CVE-2025-23061

v7.8.4

Compare Source

===================

• fix: disallow nested $where in populate match CVE-2025-23061

v7.8.3

Compare Source

==================

• fix: disallow using $where in match
• fix(projection): avoid setting projection to unknown exclusive/inclusive if elemMatch on a Date, ObjectId, etc. #​14894 #​14893
• docs(migrating_to_7): add note about keepAlive to Mongoose 7 migration guide #​15032 #​13431

v7.8.2

Compare Source

==================

• fix(projection): avoid setting projection to unknown exclusive/inclusive if elemMatch on a Date, ObjectId, etc. #​14894 #​14893

v7.8.1

Compare Source

==================

• fix(query): handle casting $switch in $expr #​14761
• docs(mongoose): remove out-of-date callback-based example for mongoose.connect() #​14811 #​14810

v7.8.0

Compare Source

==================

• feat: add transactionAsyncLocalStorage option to opt in to automatically setting session on all transactions #​14744 #​14742 #​14583 #​13889
• types(query): fix usage of "RawDocType" where "DocType" should be passed #​14737 hasezoey

v7.7.0

Compare Source

==================

• feat(model): add throwOnValidationError option for opting into getting MongooseBulkWriteError if all valid operations succeed in bulkWrite() and insertMany() #​14599 #​14587 #​14572 #​13410

v7.6.13

Compare Source

===================

• fix(query): shallow clone $or and $and array elements to avoid mutating query filter arguments #​14614 #​14610
• types: pass DocType down to subdocuments so HydratedSingleSubdocument and HydratedArraySubdocument toObject() returns correct type #​14612 #​14601
• docs(migrating_to_7): add id setter to Mongoose 7 migration guide #​14645 #​13672

v7.6.12

Compare Source

===================

• fix(array): avoid converting to $set when calling pull() on an element in the middle of the array #​14531 #​14502
• fix: bump mongodb driver to 5.9.2 #​14561 lorand-horvath
• fix(update): cast array of strings underneath doc array with array filters #​14605 #​14595

v7.6.11

Compare Source

===================

• fix(populate): avoid match function filtering out null values in populate result #​14518
• fix(schema): support setting discriminator options in Schema.prototype.discriminator() #​14493 #​14448
• fix(schema): deduplicate idGetter so creating multiple models with same schema doesn't result in multiple id getters #​14492 #​14457

v7.6.10

Compare Source

===================

• docs(model): add extra note about lean option for insertMany() skipping casting #​14415
• docs(mongoose): add options.overwriteModel details to mongoose.model() docs #​14422

v7.6.9

Compare Source

==================

• fix(document): handle embedded recursive discriminators on nested path defined using Schema.prototype.discriminator #​14256 #​14245
• types(model): correct return type for findByIdAndDelete() #​14233 #​14190
• docs(connections): add note about using asPromise() with createConnection() for error handling #​14364 #​14266
• docs(model+query+findoneandupdate): add more details about overwriteDiscriminatorKey option to docs #​14264 #​14246

v7.6.8

Compare Source

==================

• perf(schema): remove unnecessary lookahead in numeric subpath check
• fix(discriminator): handle reusing schema with embedded discriminators defined using Schema.prototype.discriminator #​14202 #​14162
• fix(ChangeStream): avoid suppressing errors in closed change stream #​14206 #​14177

v7.6.7

Compare Source

==================

• fix: avoid minimizing single nested subdocs if they are required #​14151 #​14058
• fix(populate): allow deselecting discriminator key when populating #​14155 #​3230
• fix: allow adding discriminators using Schema.prototype.discriminator() to subdocuments after defining parent schema #​14131 #​14109
• fix(schema): avoid creating unnecessary clone of schematype in nested array so nested document arrays use correct constructor #​14128 #​14101
• fix(populate): call transform object with single id instead of array when populating a justOne path under an array #​14135 #​14073
• types: add back mistakenly removed findByIdAndRemove() function signature #​14136 #​14132

v7.6.6

Compare Source

==================

• perf: avoid double-running setter logic when calling push() #​14120 #​11380
• fix(populate): set populated docs in correct order when populating virtual underneath doc array with justOne #​14105 #​14018
• fix: bump mongodb driver -> 5.9.1 #​14084 #​13829 lorand-horvath
• types: allow defining document array using [{ prop: String }] syntax #​14095 #​13424
• types: correct types for when includeResultMetadata: true is set #​14078 #​13987 prathamVaidya
• types(query): base filters and projections off of RawDocType instead of DocType so autocomplete doesn't show populate #​14118 #​14077
• types: make property names show up in intellisense for UpdateQuery #​14123 #​14090
• types(model): support calling Model.validate() with pathsToSkip option #​14088 #​14003
• docs: remove "DEPRECATED" warning mistakenly added to read() tags param #​13980

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
Error: ERR_PNPM_NO_MATCHING_VERSION

  × installing dependencies
  ╰─▶ Failed to resolve dependency tree: No matching version found for
      has@1.0.29 while fetching it from https://registry.npmjs.org/
  help: The latest release of has is "1.0.4".
        
        If you need the full list of all 6 published versions run "pnpm view
        has versions".