CVE-2022-2564
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Record
CVE-2022-2564- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2022-6328
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Record
EUVD-2022-6328- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f825-f98c-gj3g
automattic/mongoose vulnerable to Prototype pollution via Schema.path
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.
- Record
GHSA-f825-f98c-gj3g- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Record
CVE-2022-2564- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Record
CVE-2022-2564- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-f825-f98c-gj3g
automattic/mongoose vulnerable to Prototype pollution via Schema.path
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.
- Record
GHSA-f825-f98c-gj3g- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVBIT-mongoose-2022-2564 No score
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
- Record
BIT-mongoose-2022-2564- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2564 is a high vulnerability (CVSS 7.0) in Automattic Automattic/mongoose, published July 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 31.3%, the 98th percentile. Fixed in mongoose 6.4.6.
References
github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js
huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd
nvd.nist.gov/vuln/detail/CVE-2022-2564