{"id":"CVE-2023-3696","aliases":["BIT-mongoose-2023-3696","EUVD-2023-2016","GHSA-9m93-w8w6-76hh","ROOT-APP-NPM-CVE-2023-3696"],"status":"published","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","severity":{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01208,"percentile":0.68581,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-07-17T00:00:21Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"npm","package":"mongoose","fixed_in":["7.3.3","6.11.3","5.13.20"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mongoose","fixed_in":["5.13.20","6.11.3","7.3.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"mongoose","fixed_in":["6.9.1-aikido.1","6.9.1-aikido.2","6.9.1-aikido.3","6.9.1-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/mongoose","fixed_in":["6.9.1-root.io.1","6.9.1-root.io.2","6.9.1-root.io.3","6.9.1-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.11.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.20"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.20"},{"introduced":"6.0.0"},{"fixed":"6.11.3"},{"introduced":"7.0.0"},{"fixed":"7.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.11.3"}]}]},{"source":"osv","ecosystem":"npm","package":"mongoose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.20"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-aikido.1"},{"fixed":"6.9.1-aikido.2"},{"fixed":"6.9.1-aikido.3"},{"fixed":"6.9.1-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/mongoose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-root.io.1"},{"fixed":"6.9.1-root.io.2"},{"fixed":"6.9.1-root.io.3"},{"fixed":"6.9.1-root.io.4"}]}]}],"products":[{"vendor":"automattic","product":"automattic/mongoose"},{"vendor":"mongoosejs","product":"mongoose"}],"references":[{"url":"https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467","tags":["x_transferred","Exploit","Patch","fix","web"]},{"url":"https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3696","tags":["web","advisory"]},{"url":"https://github.com/Automattic/mongoose/commit/e29578d2ec18a68aeb4717d66dd5eb66bae53de1","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2","tags":["web"]},{"url":"https://github.com/Automattic/mongoose/releases/tag/7.3.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9m93-w8w6-76hh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3696.json","tags":["advisory"]},{"url":"https://github.com/Automattic/mongoose","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-3696","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","status":"published","published":"2023-07-17T00:00:21.16Z","modified":"2024-10-30T14:16:54.986Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-2016","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","status":"published","published":"2023-07-17T00:00:21Z","modified":"2024-10-30T14:16:54Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T00:05:14.330068Z"}],"ghsa":[{"id":"GHSA-9m93-w8w6-76hh","title":"Mongoose Prototype Pollution vulnerability","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.","status":"published","published":"2023-07-17T03:30:20Z","modified":"2023-11-29T22:05:59Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-3696","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","status":"published","published":"2023-07-17T01:15:08.85Z","modified":"2026-06-17T06:14:39.323Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"CVE-2023-3696","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","status":"published","published":"2023-07-17T00:00:21.16Z","modified":"2026-10-28T02:31:01.334408374Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-9m93-w8w6-76hh","title":"Mongoose Prototype Pollution vulnerability","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.","status":"published","published":"2023-07-17T03:30:20Z","modified":"2023-12-06T01:03:07.4025Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"BIT-mongoose-2023-3696","title":"Prototype Pollution in automattic/mongoose","description":"Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.","status":"published","published":"2024-03-06T10:56:42.406Z","modified":"2026-09-08T08:48:14.43292538Z","updated_at":"2026-11-02T15:28:33.469426Z"},{"id":"ROOT-APP-NPM-CVE-2023-3696","title":"CVE-2023-3696 in mongoose - Patched by Root","description":"Root has patched CVE-2023-3696 in the mongoose package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-01T06:57:58Z","modified":"2026-09-01T09:15:02.789505987Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}