---
id: CVE-2026-73562
title: >-
  Mongoose is a MongoDB object modeling tool designed to work in an asynchronous
  environment
summary: >-
  Mongoose is a MongoDB object modeling tool designed to work in an asynchronous
  environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a
  user-controlled update such as MyModel.updateOne(filter, req.body) can exploit
  Mongoose up…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-1321
published: '2026-08-13'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:05:53.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73562'
references:
  - url: >-
      https://github.com/Automattic/mongoose/commit/35a3f33bc9a0a28671f99e3c5010000425650d0f
    label: security-advisories@github.com
  - url: >-
      https://github.com/Automattic/mongoose/commit/7285466b860d3b511f8d07b2ab72656703ee707a
    label: security-advisories@github.com
  - url: >-
      https://github.com/Automattic/mongoose/commit/953d085bee5a16b5d6c5af33a156e6314d6d9a45
    label: security-advisories@github.com
  - url: >-
      https://github.com/Automattic/mongoose/commit/fab793b747131c68927888cba41cf3e6d6593740
    label: security-advisories@github.com
  - url: >-
      https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00503
epssPercentile: 0.40429
ingestedAt: '2026-09-18T20:51:25.606Z'
---

## Overview

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.