high severityConfidence highHistorical record

Mongoose sanitizeFilter was skipped on countDocuments() and cursor(), so apps that relied on it could still take injected query operators (CVE-2026-125120)

Direct answer

Mongoose sanitizeFilter was skipped on countDocuments() and cursor(), so apps that relied on it could still take injected query operators (CVE-2026-125120), also tracked as CVE-2026-125120 / GHSA-pcrw-h46h-c93h / Mongoose sanitizeFilter countDocuments bypass is a high-severity threat campaign HOL Guard tracked from Aug 10, 2026 to Nov 11, 2026, verified against 7 primary sources and last reviewed Nov 11, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

Mongoose's sanitizeFilter option (false by default) protects against query selector injection by wrapping any nested object whose keys start with $ in $eq. Advisory GHSA-pcrw-h46h-c93h (CVE-2026-125120, CVSS 3.1 9.8, CWE-943), published 2026-11-10, says that in older versions sanitizeFilter was not applied for countDocuments() queries. The fix commits route countDocuments() and Query.prototype.cursor() through the same _castConditions() path find() uses, and on older lines also count(); the changelog for all four patched releases lists the fix for both countDocuments and cursor. Fixed versions are 9.9.2, 8.24.3, 7.8.12 and 6.13.11, all published to npm on 2026-08-10. An app is exposed only if it turned sanitizeFilter on and passes request-derived objects into countDocuments() or cursor() filters; countDocuments returns a count, which still lets an attacker guess stored values one yes or no answer at a time, while cursor() can return whole documents. The advisory's published plugin workaround omits the schema parameter and throws a ReferenceError as written.

Also tracked as CVE-2026-125120 · GHSA-pcrw-h46h-c93h · Mongoose sanitizeFilter countDocuments bypass · mongoose NoSQL injection countDocuments

First observed
Aug 10, 2026
Last observed
Nov 11, 2026
Last reviewed
Nov 11, 2026
Tracking ended
Nov 11, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

The advisory rates the issue CVSS 9.8; HOL reads practical impact as lower because countDocuments returns only a count. The advisory title mentions only countDocuments; HOL's reading that cursor() was also unprotected is based on the fix commits and release changelogs, not on advisory text. Mongoose 5.x is inside the affected range and has no patched release listed.

  • Apps that never enabled sanitizeFilter (the default) gain no new exposure from this bug, though their queries never had that protection.
  • Apps that cast or validate request input to plain strings or numbers before querying are not exposed.
  • countDocuments() returns a number, not records; the attacker learns yes or no answers.
  • Not on CISA KEV; no exploitation reported in the advisory as of 2026-11-11.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not audit an application's Mongoose queries; the fix is upgrading mongoose and validating request input.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Mongoose 9.9.2, 8.24.3, 7.8.12 and 6.13.11 released with 'apply sanitizeFilter on countDocuments and cursor()'.

    Sources:Mongoose 9.9.2 release notes·Mongoose fix commit: apply sanitizeFilter on countDocuments and cursor()

  2. Disclosure

    Advisory GHSA-pcrw-h46h-c93h and CVE-2026-125120 published, rated critical (CVSS 3.1 9.8, CWE-943).

    Sources:Mongoose advisory GHSA-pcrw-h46h-c93h·GitHub reviewed advisory GHSA-pcrw-h46h-c93h

  3. Update

    HOL Guard publishes an operator write-up covering who is in scope, the cursor() gap, the broken advisory workaround and a version check.

    Source:HOL Guard: Mongoose sanitizeFilter skipped on countDocuments (CVE-2026-125120)

Publication clock: 18.9 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • mongoose@< 6.13.11; >= 7.0.0 < 7.8.12; >= 8.0.0 < 8.24.3; >= 9.0.0 < 9.9.2npmpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

Mongoose's sanitizeFilter option (false by default) protects against query selector injection by wrapping any nested object whose keys start with $ in $eq. Advisory GHSA-pcrw-h46h-c93h (CVE-2026-125120, CVSS HOL Guard tracked the campaign from Aug 10, 2026 to Nov 11, 2026.

No. Active tracking ended Nov 11, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 7 primary sources, names 1 reviewed artifact, and was last fully reviewed Nov 11, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. The advisory rates the issue CVSS 9.8; HOL reads practical impact as lower because countDocuments returns only a count.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-1AFB98DE