8.9.0
13 years ago
23 hours ago
Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of How to fix Improper Neutralization of Special Elements in Data Query Logic? Upgrade | <8.8.3 |
mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in Note: Only applications using Express and EJS are vulnerable. How to fix Prototype Pollution? Upgrade | <5.13.20>=6.0.0-rc0 <6.11.3>=7.0.0-rc0 <7.3.4 |
mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in the Note: CVE-2022-24304 is a duplicate of CVE-2022-2564. How to fix Prototype Pollution? Upgrade | <5.13.15>=6.0.0 <6.4.6 |
mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The PoC
How to fix Prototype Pollution? Upgrade | <5.12.2 |
mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Information Exposure. Any query object with a How to fix Information Exposure? Upgrade | <4.13.21>=5.0.0 <5.7.5 |
A potential memory disclosure vulnerability exists in mongoose.
A | >=3.5.5 <3.8.39>=4.0.0 <4.3.6 |