{"id":"GHSA-wpg9-53fq-2r8h","revision":"06905dddef9f452e845d4b401f3e7418","records":[{"revision":"06905dddef9f452e845d4b401f3e7418","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wpg9-53fq-2r8h","aliases":["BIT-mongoose-2026-42334","CVE-2026-42334"],"title":"Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","description":"### Impact\n\nThis vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.\n\nWhen sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.\n\nThis may lead to:\n\n- Authentication bypass\n- Unauthorized data access\n- Data exfiltration\n\n**Affected users:**\n\nApplications that:\n\n- Explicitly enable sanitizeFilter\n- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors\n\nApplications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.\n\n### Patches\n\nPatches have been released for all supported Mongoose release lines:\n\n- `^6.13.9`\n- `^7.8.9`\n- `^8.22.1`\n- `^9.1.6`   \n\n### Workarounds\n\nDelete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.\n\n### Resources\n\nsanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()\n\nOriginal blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html","state":0,"publishedAt":"2026-05-05T21:48:06+00:00","modifiedAt":"2026-05-18T08:11:23.5890073+00:00","affected":[{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.13.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.8.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.22.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mongoose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0"},{"kind":"fixed","version":"9.1.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h","https://nvd.nist.gov/vuln/detail/CVE-2026-42334","https://github.com/Automattic/mongoose","https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()","https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html"],"sourceUrl":"https://github.com/advisories/GHSA-wpg9-53fq-2r8h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wpg9-53fq-2r8h","identifiers":["GHSA-wpg9-53fq-2r8h","BIT-mongoose-2026-42334","CVE-2026-42334"]},"retained":false,"historicalAffected":[]}],"coverage":[]}