npm/mongoose CVE-2025-23061: critical 9, EPSS 7.24%

Mongoose search injection vulnerability

Action: Upgrade mongoose to 6.13.6 or later.

npm i mongoose@8.9.5

npm i mongoose@7.8.4

npm i mongoose@6.13.6

Affected

Fixed versions

Sources

• osv: GHSA-vg7j-7cwx-8wgw
• https://nvd.nist.gov/vuln/detail/CVE-2025-23061
• https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
• https://github.com/Automattic/mongoose
• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
• https://github.com/Automattic/mongoose/compare/6.13.5...6.13.6
• https://github.com/Automattic/mongoose/compare/7.8.3...7.8.4
• https://github.com/Automattic/mongoose/compare/8.9.4...8.9.5
• https://github.com/Automattic/mongoose/releases/tag/6.13.6
• https://github.com/Automattic/mongoose/releases/tag/7.8.4
• https://github.com/Automattic/mongoose/releases/tag/8.9.5
• https://github.com/advisories/GHSA-m7xq-9374-9rvx
• https://www.npmjs.com/package/mongoose?activeTab=versions

CVE-2025-23061 · published 2025-01-15T06:30:49Z · modified 2025-10-03T15:40:22Z · JSON