{"id":"CVE-2022-2564","aliases":["BIT-mongoose-2022-2564","EUVD-2022-6328","GHSA-f825-f98c-gj3g"],"status":"published","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.31301,"percentile":0.98288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2022-07-28T15:21:20Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"npm","package":"mongoose","fixed_in":["6.4.6","5.13.15"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mongoose","fixed_in":["5.13.15","6.4.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.15"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.15"},{"introduced":"6.0.0"},{"fixed":"6.4.6"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.4.6"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.15"}]}]}],"products":[{"vendor":"automattic","product":"automattic/mongoose"},{"vendor":"mongoosejs","product":"mongoose"}],"references":[{"url":"https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2564","tags":["web","advisory"]},{"url":"https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/commit/99b418941e2fc974199b8e5bd9d382bb50bf680a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f825-f98c-gj3g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2564.json","tags":["advisory"]},{"url":"https://github.com/automattic/mongoose","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-2564","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","status":"published","published":"2022-07-28T15:21:20Z","modified":"2024-11-20T16:14:46.191Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-6328","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","status":"published","published":"2022-07-28T15:21:20Z","modified":"2024-11-20T16:14:46Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:54.7374Z"}],"ghsa":[{"id":"GHSA-f825-f98c-gj3g","title":"automattic/mongoose vulnerable to Prototype pollution via Schema.path","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.","status":"published","published":"2022-07-29T00:00:18Z","modified":"2023-11-29T22:06:45Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2022-2564","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","status":"published","published":"2022-07-28T20:15:11.187Z","modified":"2026-06-17T04:42:07.56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:24.037422Z"}],"osv":[{"id":"CVE-2022-2564","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","status":"published","published":"2022-07-28T15:21:20Z","modified":"2026-10-28T02:31:04.556397357Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-f825-f98c-gj3g","title":"automattic/mongoose vulnerable to Prototype pollution via Schema.path","description":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.","status":"published","published":"2022-07-29T00:00:18Z","modified":"2023-12-06T01:02:07.656454Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"BIT-mongoose-2022-2564","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.","status":"published","published":"2024-03-06T10:56:53.276Z","modified":"2026-09-08T08:48:14.492871333Z","updated_at":"2026-11-02T15:28:33.469426Z"}]}}