{"id":"EUVD-2026-30349","enisaUuid":"2a9e04c5-ce30-34aa-94ef-0f0a043284a2","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","datePublished":"May 14, 2026, 6:03:43 PM","dateUpdated":"May 14, 2026, 6:18:06 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h\n","aliases":"CVE-2026-42334\nGHSA-wpg9-53fq-2r8h\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"7f09bf68-c562-3bd0-8d33-6e80b39bd2d2","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"7.0.0, ≤ 7.8.8"},{"id":"baa34887-ece9-35de-a0fa-96e8567d699c","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"9.0.0, ≤ 9.1.5"},{"id":"edb11e53-0e48-38a3-bfdc-213f317a6e60","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"8.0.0, ≤ 8.22.0"},{"id":"fdb02c7f-480f-35dc-9248-f630b6777ffd","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"\u003c 6.13.9"}],"enisaIdVendor":[{"id":"2c0aa93a-493f-335e-9c26-9fdc5cc92ff8","vendor":{"name":"Automattic"}}],"enisaIdVulnerability":[{"id":"0a273e95-650c-36df-bfff-85a0a9394b3e","vulnerability":{"id":"GHSA-wpg9-53fq-2r8h","description":"Mongoose\u0027s Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","datePublished":"May 5, 2026, 9:48:06 PM","dateUpdated":"May 14, 2026, 8:53:38 PM","baseScore":0.0,"references":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42334\nhttps://github.com/Automattic/mongoose\nhttps://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()\nhttps://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html\n","enisa_id":"EUVD-2026-30349\n","aliases":"GHSA-wpg9-53fq-2r8h\nCVE-2026-42334\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4c53d822-0faf-3250-bd1f-9b8c10bcf384","vulnerability":{"id":"CVE-2026-42334","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.","datePublished":"May 14, 2026, 6:03:43 PM","dateUpdated":"May 14, 2026, 6:18:06 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h\n","enisa_id":"EUVD-2026-30349\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"48480f57-1f80-3142-856d-d89d8d173365","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"7.0.0, ≤ 7.8.8"},{"id":"a0e718cc-cfd2-36a9-b3bf-3c48f1c7cd8f","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"9.0.0, ≤ 9.1.5"},{"id":"c24c5323-1fe1-3ff1-ab07-b9522b62bac3","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"8.0.0, ≤ 8.22.0"},{"id":"c75bb36b-a2d8-34c1-ac7a-56539d7dc215","product":{"name":"Mongoose","vendor":{"name":"Automattic"}},"product_version":"\u003c 6.13.9"}],"vulnerabilityVendor":[{"id":"b321d8d8-c665-3d25-92d1-09b416132991","vendor":{"name":"Automattic"}}]}}],"enisaIdAdvisory":[]}