{"id":"EM-20261110-EZYH","url":"https://cyber.eventmonitor.net/incident/EM-20261110-EZYH/mongoose-vulnerability-cve-2026-125119/","type":"cve","title":"Mongoose Vulnerability (CVE-2026-125119)","subtitle":"CVE-2026-125119","subject":"CVE-2026-125119","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T19:56:12.000Z","firstSignal":"2026-11-09T23:17:22.397Z","lastSignal":"2026-11-10T19:56:12.000Z","updated":"2026-11-10T20:23:48.430Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T19:56:12.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T19:56:12.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T23:17:22.397Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-10T19:56:12.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-EZYH created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T23:17:22.397Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T23:17:22.397Z","detail":"CVSS 7.5 · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T23:17:22.397Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-125119 (CVSS 7.5)","text":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125119"},{"at":"2026-11-10T19:56:12.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-gg4r-jv3p-qx3c / CVE-2026-125119: Mongoose: Connection-level sanitizeFilter not applied","text":"npm:mongoose, npm:mongoose, npm:mongoose, npm:mongoose","url":"https://github.com/advisories/GHSA-gg4r-jv3p-qx3c"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T23:17:22.397","score":7.5,"severity":"HIGH","desc":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other…","product":"","seen":1794276929232},"kev":null,"epss":{"epss":0.00541,"pct":0.45818,"at":1794342228430},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}