Homepage
About Snyk

mongoose@6.4.0 vulnerabilities

Mongoose MongoDB ODM

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

Note: Only applications using Express and EJS are vulnerable.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.20, 6.11.3, 7.3.4 or higher.

<5.13.20 >=6.0.0-rc0 <6.11.3 >=7.0.0-rc0 <7.3.4
  • H
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

<5.13.15 >=6.0.0 <6.4.6
Go back to all versions of this package