Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
Lead record- Why these records are connected
- Records explicitly naming the same CVE identifier.
- Connection key
cve:CVE-2026-125116- Public snapshot refreshed
- today 23:13 UTC
- Distinct source events
- 4
- Source records represented
- 4
Current snapshot membership is shown here. Source histories and cited revisions remain on each record. Future source targets are labelled separately from observed changes. Browse connections.
Evidence in chronological order
- Tue 10 Nov · Dated source evidence · Newly collected advisory Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsCVE-2026-125116 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Tue 10 Nov · Dated source evidence · Newly collected advisory Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsGHSA-wr5m-5jph-8m96 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Thu 12 Nov · Dated source evidence · Advisory content revised Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index …EUVD-2026-120497 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Thu 12 Nov · Dated source evidence · Advisory content revised Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index …CVE-2026-125116 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.