CVE-2026-125119

Mongoose prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4 allows Schema.prototype.virtual() to build nested virtual paths without the special-property validation used by Schema.path() and Schema.add(). An attacker able to influence virtual field names can supply path segments such as __proto__, constructor, or prototype, causing prototype pollution of Object.prototype or Function.prototype. This can spoof inherited property checks such as authorization flags.

Mongoose can descend into inherited properties while loading documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can cause writes into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until process restart. Additionally, when an attacker controls the dotted path passed to doc.set() for a subdocument with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options.

Mongoose prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4 uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can resolve to inherited built-in functions, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting, and a stored poisoned document can make every query that hydrates it fail until removed.

Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function tests hm.proto.len with an impossible greater-than-eight condition, so is_http_1_0 is never set, and Mongoose processes chunked encoding that an HTTP/1.0 proxy can ignore.

A vulnerability in Mongoose before version 7.22 allows an on-path network attacker with a wildcard certificate for a parent domain to impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern like *.example.com can match foo.bar.example.com.

A vulnerability in Mongoose before version 7.23 allows a network attacker to impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. The mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without verifying the certificate signature.

In Mongoose prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests to mg_http_upload or mg_http_serve_dir with affected short path shapes could trigger one-byte heap out-of-bounds reads.

Mongoose, an embedded web server and network library, prior to 7.23 does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy.