{"id":"CVE-2026-42334","aliases":["BIT-mongoose-2026-42334","GHSA-wpg9-53fq-2r8h"],"url":"https://o3.security/vulnerability/CVE-2026-42334","summary":"Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection","details":"### Impact\n\nThis vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator.\n\nWhen sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operators that are recursively sanitized. Because `$nor` accepts an array (like `$and` and `$or`), and arrays do not trigger `hasDollarKeys()`, malicious operators such as `$ne`, `$gt`, or `$regex` could be injected inside a `$nor` clause without being sanitized.\n\nThis may lead to:\n\n- Authentication bypass\n- Unauthorized data access\n- Data exfiltration\n\n**Affected users:**\n\nApplications that:\n\n- Explicitly enable sanitizeFilter\n- Pass unsanitized user-controlled input directly into query methods (e.g., `Model.findOne(req.body)`) and rely on `sanitizeFilter` to strip out query selectors\n\nApplications that validate input schemas, whitelist fields, or avoid passing raw request bodies into queries are not affected. For example, `Model.findOne({ user: req.body.user, pwd: req.body.pwd })` is not affected.\n\n### Patches\n\nPatches have been released for all supported Mongoose release lines:\n\n- `^6.13.9`\n- `^7.8.9`\n- `^8.22.1`\n- `^9.1.6`   \n\n### Workarounds\n\nDelete `$nor` keys, use an additional schema validation library, or write middleware to strip out `$nor` from query filters.\n\n### Resources\n\nsanitizeFilter documentation: https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()\n\nOriginal blog post on sanitizeFilter: https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html","published":"2026-05-14T18:03:43.196Z","modified":"2026-08-12T03:51:44.411383609Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00274,"percentile":0.19241,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mongoose","fixedVersion":"6.13.9"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"7.8.9"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"8.22.1"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"9.1.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42334.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42334"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://mongoosejs.com/docs/api/mongoose.html#Mongoose.prototype.sanitizeFilter()"},{"type":"WEB","url":"https://thecodebarbarian.com/whats-new-in-mongoose-6-sanitizefilter.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.411383609Z"}}