CVE-2026-73562

npm/mongoose CVE-2026-73562: medium 6.5, EPSS 0.50%

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Action: Upgrade mongoose to 6.13.10 or later.

npm i mongoose@6.13.10

npm i mongoose@7.8.10

npm i mongoose@8.24.1

npm i mongoose@9.7.2

Affected

Fixed versions

Sources

• osv: GHSA-664h-wqgq-64gw
• https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
• https://github.com/Automattic/mongoose/pull/16230
• https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b
• https://github.com/Automattic/mongoose
• https://github.com/Automattic/mongoose/releases/tag/6.13.10
• https://github.com/Automattic/mongoose/releases/tag/7.8.10
• https://github.com/Automattic/mongoose/releases/tag/8.24.1
• https://github.com/Automattic/mongoose/releases/tag/9.7.2

CVE-2026-73562 · published 2026-07-24T16:22:34Z · modified 2026-08-19T09:55:54.203227351Z · JSON