Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T18:18:18.643Z",
  "pubdate": "2026-08-13T18:18:18.643Z",
  "executiveSummary": "A prototype pollution vulnerability exists in the Mongoose MongoDB object modeling tool prior to versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. The vulnerability arises from improper handling of user-controlled update operations, specifically when processing dotted paths containing __proto__.x under the $set operator.\nThe flaw allows an attacker capable of supplying unvalidated input to update operations, such as MyModel.updateOne(filter, req.body), to manipulate the global Object.prototype. Successful exploitation populates Object.prototype with internal properties such as $fullPath and $parentSchemaDocArray before the execution throws an error.\nThis pollution compromises application integrity and availability by injecting properties into newly created objects globally across the runtime environment. Exploitation requires the application to pass user-controlled input directly into update query parameters without prior sanitization or strict schema enforcement.",
  "technicalDetails": "The root cause of the vulnerability resides in Schema.prototype.path and Schema.prototype._getPathType. These internal Mongoose methods incorrectly treat inherited properties of schema.paths and schema.nested as valid schema types during the update casting process.\nWhen an attacker supplies a user-controlled update payload containing a dotted path such as __proto__.x under the $set operator to methods like MyModel.updateOne(filter, req.body), the casting mechanism traverses the prototype chain.\nThe vulnerable components process the prototype properties as part of the schema definition mapping. During this recursive casting evaluation, the execution sets internal properties such as $fullPath and $parentSchemaDocArray directly onto Object.prototype.\nAlthough the operation ultimately throws an error due to invalid type resolution, the side effect of modifying Object.prototype has already occurred. Consequently, all subsequently instantiated objects inherit these injected properties.\nThis results in persistent prototype pollution, potentially leading to denial of service through availability degradation or unexpected application logic flaws depending on how the modified objects are consumed by the runtime environment."
}