Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-42334 · Microsoft / collected KEV context

EUVD-2026-30349

GHSA-wpg9-53fq-2r8h

BIT-mongoose-2026-42334

cve-program · CVE-2026-42334

• https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h

euvd · EUVD-2026-30349

• https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h

nvd · CVE-2026-42334

• https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h

osv · GHSA-wpg9-53fq-2r8h

• https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h
• https://nvd.nist.gov/vuln/detail/CVE-2026-42334
• https://github.com/Automattic/mongoose
• https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()
• https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html

No related operational record is retained in the current change model.