Skip to contentAutomattic Mongoose vulnerabilities
- automattic mongooseMongoose: sanitizeFilter not applied on countDocumentsCVE-2026-125120Fix available9.8 Critical
- automattic mongooseMongoose: Connection-level sanitizeFilter not appliedCVE-2026-125119Fix available7.5 High
- automattic mongooseMongoose: Prototype pollution via Schema.prototype.virtual()CVE-2026-125118Fix available6.5 Medium
- automattic mongooseMongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema stateCVE-2026-125117Fix available8.2 High
- automattic mongooseMongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsCVE-2026-125116Fix available4.8 Medium
- automattic mongooseMongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)CVE-2026-115473Fix available6.5 Medium
- automattic mongooseMongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)CVE-2026-63626Fix available8.8 High
- automattic mongooseMongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connectionCVE-2026-73261Fix available7.5 High
- automattic mongooseMongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parserCVE-2026-73260Fix available7.5 High
- automattic mongooseMongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAXCVE-2026-73252Fix available7.5 High
- automattic mongooseCesanta Mongoose MQTT Broker main.c fn stack-based overflowCVE-2026-101003Fix available6.9 Medium
- automattic mongooseMongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard MatchingCVE-2026-73253Fix available9.1 Critical
- automattic mongooseMongoose: Path traversal in SSI #include directives enables arbitrary file readCVE-2026-73255Fix available6.5 Medium
- automattic mongooseMongoose: Reflected XSS via decoded URI in directory listing renderCVE-2026-73259Fix available5.4 Medium
- automattic mongooseMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TECVE-2026-73256Fix available9.1 Critical
- automattic mongooseMongoose: Stored XSS via unescaped filenames in directory listingCVE-2026-73254Fix available5.4 Medium
- automattic mongooseMongoose: Multipart boundary/header scan logic error in mg_http_next_multipartCVE-2026-73258Fix available6.5 Medium
- automattic mongooseMongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verificationCVE-2026-73251Fix available9.3 Critical
- automattic mongooseMongoose: Content-Length + Transfer-Encoding coexistence enables request smugglingCVE-2026-73257Fix available9.1 Critical
- automattic mongooseMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)CVE-2026-73562Fix available6.5 Medium
- automattic mongooseCesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID ParsingCVE-2026-11404Fix available8.7 High
- automattic mongooseMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionCVE-2026-42334Fix available7.5 High
- automattic mongooseCesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationCVE-2026-6986Fix available6.3 Medium
- automattic mongooseCesanta Mongoose TCP Option net_builtin.c handle_opt infinite loopCVE-2026-6985Fix available6.9 Medium
- automattic mongooseCesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorizationCVE-2026-5246Fix available6.3 Medium
- automattic mongooseCesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflowCVE-2026-5245Fix available6.3 Medium
- automattic mongooseCesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflowCVE-2026-5244Fix available6.9 Medium
- automattic mongooseCesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verificationCVE-2026-2968Fix available6.3 Medium
- automattic mongooseCesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourceCVE-2026-2967Fix available6.3 Medium
- automattic mongooseCesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random valuesCVE-2026-2966Fix available6.3 Medium
- automattic mongooseMongoose search injection vulnerabilityCVE-2025-23061Public exploitFix available9.0 Critical
- automattic mongooseMongoose search injection vulnerabilityCVE-2024-53900Public exploitFix available9.1 Critical
- automattic mongooseCesanta Mongoose MQTT Message Parsing Heap OverflowCVE-2023-2905Fix available8.8 High
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongooseCVE-2023-3696Fix available10.0 Critical
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongooseCVE-2022-2564Fix availableEPSS 31.3%7.0 High
- automattic mongooseAn exploitable memory corruption vulnerability exists in the Websocket protocol implementation of...CVE-2017-2922Fix available9.8 Critical
- automattic mongooseAn exploitable memory corruption vulnerability exists in the Websocket protocol implementation of...CVE-2017-2921Fix available8.1 High
- automattic mongooseAn infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8...CVE-2017-2909Fix available7.5 High
- automattic mongooseAn exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing...CVE-2017-2895Fix available8.2 High
- automattic mongooseAn exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing...CVE-2017-2894Fix availableEPSS 31.0%9.8 Critical
- automattic mongooseAn exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing...CVE-2017-2893Fix availableEPSS 24.9%7.5 High
- automattic mongooseAn exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing...CVE-2017-2892Fix available9.8 Critical
- automattic mongooseAn exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta...CVE-2017-2891Fix available9.8 Critical