{"action":"Upgrade mongoose to 6.13.9 or later.","affected":[{"fixed":"6.13.9","introduced":"0"},{"fixed":"7.8.9","introduced":"7.0.0"},{"fixed":"8.22.1","introduced":"8.0.0"},{"fixed":"9.1.6","introduced":"9.0.0"}],"component":"mongoose","cve_ids":["CVE-2026-42334"],"ecosystem":"npm","epss":0.00274,"exploited":false,"fixed_versions":["6.13.9","7.8.9","8.22.1","9.1.6"],"ghsa_id":"GHSA-wpg9-53fq-2r8h","id":"tcs_01M5KGFJXMYNMT0WJ8Q0H10JQ7","modified_at":"2026-05-18T08:11:23.589007268Z","published_at":"2026-05-05T21:48:06Z","references":["https://osv.dev/vulnerability/GHSA-wpg9-53fq-2r8h","https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h","https://nvd.nist.gov/vuln/detail/CVE-2026-42334","https://github.com/Automattic/mongoose","https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()","https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wpg9-53fq-2r8h","url":"https://osv.dev/vulnerability/GHSA-wpg9-53fq-2r8h"}],"summary":"Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection"}