{"id":"EM-20261110-LMJO","url":"https://cyber.eventmonitor.net/incident/EM-20261110-LMJO/mongoose-vulnerability-cve-2026-125117/","type":"cve","title":"Mongoose Vulnerability (CVE-2026-125117)","subtitle":"CVE-2026-125117","subject":"CVE-2026-125117","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T20:56:16.000Z","firstSignal":"2026-11-09T23:17:22.080Z","lastSignal":"2026-11-10T20:56:16.000Z","updated":"2026-11-10T21:24:46.420Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T20:56:16.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T20:56:16.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T23:17:22.080Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-10T20:56:16.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-LMJO created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T23:17:22.080Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T23:17:22.080Z","detail":"CVSS 8.2 · EPSS 0.6%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T23:17:22.080Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-125117 (CVSS 8.2)","text":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125117"},{"at":"2026-11-10T20:56:16.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-8332-j7wj-wjw4 / CVE-2026-125117: Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state","text":"npm:mongoose, npm:mongoose, npm:mongoose, npm:mongoose","url":"https://github.com/advisories/GHSA-8332-j7wj-wjw4"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T23:17:22.080","score":8.2,"severity":"HIGH","desc":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in…","product":"","seen":1794338539165},"kev":null,"epss":{"epss":0.00584,"pct":0.48255,"at":1794345886420},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}