Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73562 · Microsoft / collected KEV context

GHSA-664h-wqgq-64gw

BIT-mongoose-2026-73562

cve-program · CVE-2026-73562

• https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
• https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f
• https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a
• https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45
• https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740

nvd · CVE-2026-73562

• https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f
• https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a
• https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45
• https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740
• https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw

osv · GHSA-664h-wqgq-64gw

• https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
• https://github.com/Automattic/mongoose/pull/16230
• https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b
• https://github.com/Automattic/mongoose
• https://github.com/Automattic/mongoose/releases/tag/6.13.10
• https://github.com/Automattic/mongoose/releases/tag/7.8.10
• https://github.com/Automattic/mongoose/releases/tag/8.24.1
• https://github.com/Automattic/mongoose/releases/tag/9.7.2

No related operational record is retained in the current change model.