Vulnerability-Lookup

GHSA-8332-J7WJ-WJW4

Vulnerability from github – Published: 2026-11-10 20:56 – Updated: 2026-11-10 20:56

Summary

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Details

Summary

Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherited from its prototype:

Loading a document from the database (init(), also used by Model.hydrate())
Setting a dotted path on a document ($__set, used by new Model(obj), doc.set() and doc.$set())
Merging update documents (utils.mergeClone, used by findOneAndReplace(), chained update calls and Query.prototype.merge())

When a key names an inherited property, such as toString or valueOf, or a document internal such as $__schema, Mongoose writes into the shared object behind that property. The data comes from the attacker.

Denial of service. For example, { "toString": { "call": 1 } } overwrites Object.prototype.toString.call. Mongoose and most other libraries rely on Object.prototype.toString.call(). After the overwrite, every later query in the process throws TypeError: _toString.call is not a function until the process restarts. This includes queries on unrelated models.
Changing shared schema state. Through a subdocument with strict: false, a path such as profile.$__schema.paths.email.validators reaches the subdocument's schema, which every document shares. Setting it to [] removes the required validator for every document in the process.

Mongoose already blocked __proto__, constructor and prototype, so these bugs cannot add properties to Object.prototype itself. They can still overwrite methods and properties of shared built-in functions and of Mongoose's internal objects.

Details

1. Loading documents: `init()`

if (!schemaType && utils.isPOJO(value)) {
  // assume nested object
  if (!doc[i]) { doc[i] = {}; ... }
  init(self, value, doc[i], opts, path + '.');
}

For a stored field named toString, doc[i] is the inherited Object.prototype.toString. It is truthy, so init() recurses into that function and copies the stored subfields onto it.

This runs for every document Mongoose loads: find(), findOne(), cursors, populated documents and Model.hydrate(). It runs whatever the strict setting, and it applies to top-level and nested paths alike. lean() queries are not affected.

A malicious document can get into the collection in several ways: - through a model with strict: false, for example new Model(req.body).save(); - through another application or the raw MongoDB driver; - through any update that writes arbitrary keys.

2. Setting dotted paths: `$__set`

When it walks a dotted path, $__set read obj[parts[i]] and descended into whatever it found. That included inherited functions, such as Object.prototype.toString on a plain object or Document.prototype.toObject on a subdocument. On subdocuments it also included non-function internals that are prototype getters, such as $__schema, schema, $__middleware and $__schemaTypeOptions. Those point at objects that every document of the model shares.

Attacker-controlled input reaches this path through: - A Mixed path on a default, strict schema: new Model({ "mixed.toString.call": 1 }), or doc.set({ "mixed.toString.call": 1 }). Nothing needs to be saved. - Any root path on a schema with strict: false: for example doc.set('toString.call', 1). - A subdocument with strict: false, when the application passes a user-controlled path to doc.set(path, value): for example doc.set('profile.$__schema.paths.email.validators', []).

3. Merging updates: `utils.mergeClone`

if (typeof to[key] === 'undefined') {
  to[key] = clone(fromObj[key]);
} else if (isObject(val)) {
  mergeClone(to[key], val);   // to[key] may be an inherited built-in
}

to[key] was read without an own-property check, so a key such as toString recursed into Object.prototype.toString. This affects:

Model.findOneAndReplace(filter, replacement). It always merges the replacement into the query's update, so a single call with an untrusted replacement is enough.
Update calls chained onto a query that already has an update. For example Model.updateOne(filter, { $set: {...} }).updateOne({}, untrustedUpdate), the same pattern with findOneAndUpdate(), or middleware that calls this.updateOne(...).
Query.prototype.merge() with a source query whose update came from untrusted input.

Proof of concept

const mongoose = require('mongoose');
const { Schema } = mongoose;

// 2. Setting dotted paths: a Mixed path on a default strict schema, nothing saved
const Item = mongoose.model('Item', new Schema({ name: String, meta: {} }));
new Item(JSON.parse('{"meta.toString.call": 1}'));  // e.g. new Item(req.body)
console.log(typeof Object.prototype.toString.call); // 'number'
// From here on, every query in the process fails:
// TypeError: _toString.call is not a function

// 1. Loading documents: a stored field named after an Object.prototype method
const Loose = mongoose.model('Loose', new Schema({ name: String }, { strict: false }));
await new Loose(JSON.parse('{"name":"evil","toString":{"call":1}}')).save();
await Loose.findOne({ name: 'evil' });              // any later read of this document
await OtherModel.findOne();                         // TypeError: _toString.call is not a function

// 3. Merging updates: a single findOneAndReplace() call with an untrusted replacement
const Doc = mongoose.model('Doc', new Schema({ name: String }));
Doc.findOneAndReplace({}, JSON.parse('{"toString":{"call":1}}'));
console.log(typeof Object.prototype.toString.call); // 'number'

// 2. Setting dotted paths: changing the shared subdocument schema
const User = mongoose.model('User', new Schema({
  profile: new Schema({ email: { type: String, required: true } }, { strict: false })
}));
// e.g. JSON-patch style endpoint: doc.set(req.body.path, req.body.value)
new User({ profile: { email: 'a@b.c' } }).set('profile.$__schema.paths.email.validators', []);
await new User({ profile: {} }).validate();         // resolves: `required` removed for every document

Impact

Denial of service (paths 1, 2 and 3). One request overwrites Object.prototype.toString.call. After that, every query in the process fails, and so does much other code, until the process restarts. Ways in:
new Model(req.body) on any schema with a Mixed path;
findOneAndReplace() with an untrusted replacement;
reading one stored document that contains a field such as { "toString": { "call": 1 } }.

In the stored-document case, the attacker does not need any write path through Mongoose at the moment of the attack. Any later read of that document triggers the overwrite. If the document is read on startup or by a scheduled job, the application can be kept down. - Changes to shared state (path 2, strict: false subdocuments). An attacker who controls the path passed to doc.set(path, value) can change a subdocument schema that every document shares. For example, they can remove validators or change schema options for every later document in the process. - Properties on built-in functions. More generally, an attacker can attach properties they choose to built-in functions such as Object.prototype.toString, Object.prototype.valueOf and Function.prototype.call. Any other code that reads properties of those functions sees the attacker's values.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mongoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.13.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mongoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.8.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mongoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.24.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "mongoose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-125117"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T20:56:16Z",
    "nvd_published_at": "2026-11-09T23:17:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThree Mongoose code paths copy data into objects by property name without checking whether the property is the object\u0027s own or inherited from its prototype:\n\n1. Loading a document from the database (`init()`, also used by `Model.hydrate()`)\n2. Setting a dotted path on a document (`$__set`, used by `new Model(obj)`, `doc.set()` and `doc.$set()`)\n3. Merging update documents (`utils.mergeClone`, used by `findOneAndReplace()`, chained update calls and `Query.prototype.merge()`)\n\nWhen a key names an inherited property, such as `toString` or `valueOf`, or a document internal such as `$__schema`, Mongoose writes into the shared object behind that property. The data comes from the attacker.\n\n- **Denial of service.** For example, `{ \"toString\": { \"call\": 1 } }` overwrites `Object.prototype.toString.call`. Mongoose and most other libraries rely on `Object.prototype.toString.call()`. After the overwrite, every later query in the process throws `TypeError: _toString.call is not a function` until the process restarts. This includes queries on unrelated models.\n- **Changing shared schema state.** Through a subdocument with `strict: false`, a path such as `profile.$__schema.paths.email.validators` reaches the subdocument\u0027s schema, which every document shares. Setting it to `[]` removes the `required` validator for every document in the process.\n\nMongoose already blocked `__proto__`, `constructor` and `prototype`, so these bugs cannot add properties to `Object.prototype` itself. They can still overwrite methods and properties of shared built-in functions and of Mongoose\u0027s internal objects.\n\n### Details\n\n#### 1. Loading documents: `init()`\n\n```js\nif (!schemaType \u0026\u0026 utils.isPOJO(value)) {\n  // assume nested object\n  if (!doc[i]) { doc[i] = {}; ... }\n  init(self, value, doc[i], opts, path + \u0027.\u0027);\n}\n```\n\nFor a stored field named `toString`, `doc[i]` is the inherited `Object.prototype.toString`. It is truthy, so `init()` recurses into that function and copies the stored subfields onto it.\n\nThis runs for every document Mongoose loads: `find()`, `findOne()`, cursors, populated documents and `Model.hydrate()`. It runs whatever the `strict` setting, and it applies to top-level and nested paths alike. `lean()` queries are not affected.\n\nA malicious document can get into the collection in several ways:\n- through a model with `strict: false`, for example `new Model(req.body).save()`;\n- through another application or the raw MongoDB driver;\n- through any update that writes arbitrary keys.\n\n#### 2. Setting dotted paths: `$__set`\n\nWhen it walks a dotted path, `$__set` read `obj[parts[i]]` and descended into whatever it found. That included inherited functions, such as `Object.prototype.toString` on a plain object or `Document.prototype.toObject` on a subdocument. On subdocuments it also included non-function internals that are prototype getters, such as `$__schema`, `schema`, `$__middleware` and `$__schemaTypeOptions`. Those point at objects that every document of the model shares.\n\nAttacker-controlled input reaches this path through:\n- **A `Mixed` path on a default, strict schema:** `new Model({ \"mixed.toString.call\": 1 })`, or `doc.set({ \"mixed.toString.call\": 1 })`. Nothing needs to be saved.\n- **Any root path on a schema with `strict: false`:** for example `doc.set(\u0027toString.call\u0027, 1)`.\n- **A subdocument with `strict: false`**, when the application passes a user-controlled path to `doc.set(path, value)`: for example `doc.set(\u0027profile.$__schema.paths.email.validators\u0027, [])`.\n\n#### 3. Merging updates: `utils.mergeClone`\n\n```js\nif (typeof to[key] === \u0027undefined\u0027) {\n  to[key] = clone(fromObj[key]);\n} else if (isObject(val)) {\n  mergeClone(to[key], val);   // to[key] may be an inherited built-in\n}\n```\n\n`to[key]` was read without an own-property check, so a key such as `toString` recursed into `Object.prototype.toString`. This affects:\n\n- **`Model.findOneAndReplace(filter, replacement)`.** It always merges the replacement into the query\u0027s update, so a single call with an untrusted replacement is enough.\n- **Update calls chained onto a query that already has an update.** For example `Model.updateOne(filter, { $set: {...} }).updateOne({}, untrustedUpdate)`, the same pattern with `findOneAndUpdate()`, or middleware that calls `this.updateOne(...)`.\n- **`Query.prototype.merge()`** with a source query whose update came from untrusted input.\n\n### Proof of concept\n\n```js\nconst mongoose = require(\u0027mongoose\u0027);\nconst { Schema } = mongoose;\n\n// 2. Setting dotted paths: a Mixed path on a default strict schema, nothing saved\nconst Item = mongoose.model(\u0027Item\u0027, new Schema({ name: String, meta: {} }));\nnew Item(JSON.parse(\u0027{\"meta.toString.call\": 1}\u0027));  // e.g. new Item(req.body)\nconsole.log(typeof Object.prototype.toString.call); // \u0027number\u0027\n// From here on, every query in the process fails:\n// TypeError: _toString.call is not a function\n```\n\n```js\n// 1. Loading documents: a stored field named after an Object.prototype method\nconst Loose = mongoose.model(\u0027Loose\u0027, new Schema({ name: String }, { strict: false }));\nawait new Loose(JSON.parse(\u0027{\"name\":\"evil\",\"toString\":{\"call\":1}}\u0027)).save();\nawait Loose.findOne({ name: \u0027evil\u0027 });              // any later read of this document\nawait OtherModel.findOne();                         // TypeError: _toString.call is not a function\n```\n\n```js\n// 3. Merging updates: a single findOneAndReplace() call with an untrusted replacement\nconst Doc = mongoose.model(\u0027Doc\u0027, new Schema({ name: String }));\nDoc.findOneAndReplace({}, JSON.parse(\u0027{\"toString\":{\"call\":1}}\u0027));\nconsole.log(typeof Object.prototype.toString.call); // \u0027number\u0027\n```\n\n```js\n// 2. Setting dotted paths: changing the shared subdocument schema\nconst User = mongoose.model(\u0027User\u0027, new Schema({\n  profile: new Schema({ email: { type: String, required: true } }, { strict: false })\n}));\n// e.g. JSON-patch style endpoint: doc.set(req.body.path, req.body.value)\nnew User({ profile: { email: \u0027a@b.c\u0027 } }).set(\u0027profile.$__schema.paths.email.validators\u0027, []);\nawait new User({ profile: {} }).validate();         // resolves: `required` removed for every document\n```\n\n### Impact\n\n- **Denial of service (paths 1, 2 and 3).** One request overwrites `Object.prototype.toString.call`. After that, every query in the process fails, and so does much other code, until the process restarts. Ways in:\n  - `new Model(req.body)` on any schema with a `Mixed` path;\n  - `findOneAndReplace()` with an untrusted replacement;\n  - reading one stored document that contains a field such as `{ \"toString\": { \"call\": 1 } }`.\n\n  In the stored-document case, the attacker does not need any write path through Mongoose at the moment of the attack. Any later read of that document triggers the overwrite. If the document is read on startup or by a scheduled job, the application can be kept down.\n- **Changes to shared state (path 2, `strict: false` subdocuments).** An attacker who controls the path passed to `doc.set(path, value)` can change a subdocument schema that every document shares. For example, they can remove validators or change schema options for every later document in the process.\n- **Properties on built-in functions.** More generally, an attacker can attach properties they choose to built-in functions such as `Object.prototype.toString`, `Object.prototype.valueOf` and `Function.prototype.call`. Any other code that reads properties of those functions sees the attacker\u0027s values.",
  "id": "GHSA-8332-j7wj-wjw4",
  "modified": "2026-11-10T20:56:16Z",
  "published": "2026-11-10T20:56:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Automattic/mongoose"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state"
}

CVE-2026-125117 (GCVE-0-2026-125117)

Vulnerability from cvelistv5 – Published: 2026-11-09 22:26 – Updated: 2026-11-10 16:20

Title

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Summary

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:20 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

11 references

URL	Tags
https://github.com/Automattic/mongoose/security/a…	x_refsource_CONFIRM
https://github.com/Automattic/mongoose/commit/18b…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/2a1…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/3cb…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/85c…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/8ce…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/8eb…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Automattic	mongoose	Affected: < 6.13.12 Affected: >= 7.0.0, < 7.8.13 Affected: >= 8.0.0, < 8.24.7 Affected: >= 9.0.0, < 9.11.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125117",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:20:05.167833Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T16:20:41.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mongoose",
          "vendor": "Automattic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.13.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.24.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.11.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T22:26:29.758Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/6.13.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/7.8.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/8.24.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/9.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4"
        }
      ],
      "source": {
        "advisory": "GHSA-8332-j7wj-wjw4",
        "discovery": "UNKNOWN"
      },
      "title": "Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125117",
    "datePublished": "2026-11-09T22:26:29.758Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:20:41.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-8332-J7WJ-WJW4

Summary

Details

1. Loading documents: init()

2. Setting dotted paths: $__set

3. Merging updates: utils.mergeClone

Proof of concept

Impact

CVE-2026-125117 (GCVE-0-2026-125117)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

1. Loading documents: `init()`

2. Setting dotted paths: `$__set`

3. Merging updates: `utils.mergeClone`