Answer in brief
CVE-2026-125119 records a High severity (CVSS 7.5) vulnerability in Mongoose: Connection-level sanitizeFilter not applied. The current sources do not mark it as known exploited. The current feed maps Automattic/mongoose (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Automattic/mongoose (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Automattic/mongoosegeneric | >=6.0.0 <6.13.12 || >=7.0.0 <7.8.13 || >=8.0.0 <8.24.7 || >=9.0.0 <9.11.4 | 6.13.12, 7.8.13, 8.24.7, 9.11.4 |
Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Quoted source text, attributed separately from HOL analysis.