Mongoose Patches Query Sanitization Gap in countDocuments()

What Happened

Automattic published a security advisory (GHSA-pcrw-h46h-c93h, tracked as CVE-2026-125120, CVSS 9.8) affecting Mongoose, the MongoDB object modeling library for Node.js. According to the advisory, Mongoose's sanitizeFilter protection was not applied to countDocuments() queries in older versions. sanitizeFilter is the mechanism meant to protect against query selector injection attacks. The advisory lists the exploit status as proof-of-concept public.

Why It Matters

Query selector injection in Mongoose applications can let an attacker manipulate query logic by injecting operators such as $ne or $gt through user-controlled input that reaches a filter object. If an application relied on sanitizeFilter as a defense, the missing check on countDocuments() could leave that path exposed. Count queries are common in pagination and existence checks, so untrusted input can reach them.

What Defenders Should Do Now

• Inventory Node.js services using Mongoose and check the installed version against the patched releases: ^9.9.2, ^8.24.3, ^7.8.12, ^6.13.11.
• Prioritize upgrading any service where countDocuments() is called with user-controllable filter objects.
• If immediate patching is not possible, apply the documented workaround. It is a Mongoose plugin that forces sanitizeFilter on the countDocuments pre-hook.
• Review application code for places where raw request bodies or query strings pass directly into Mongoose filter objects without validation.
• Audit for MongoDB query operators appearing in request parameters, such as keys like $ne, $gt, or $regex, as a general injection indicator.

Developing Intel

This is a same-day disclosure and details may change as real-world exploitability is assessed. For the official details and the workaround code, see the GitHub Security Advisory.