Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2025-23061 — CRITICAL severity vulnerability | Release Alert

CVE-2025-23061

9

CRITICALCVSS v3

Published

January 15, 2025

Affected

8 projects

Assigned by

MITRE

Severity scale

010

Description

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

NPMMongoose MongoDB ODM

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

@types/mongoose

NPMStub TypeScript definitions entry for mongoose, which provides its own types definitions

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

@bakjs/mongoose

NPM

More on this CVE

NVD↗GitHub Advisory↗

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

cesanta/mongoose

GitHubEmbedded web server, with TCP/IP network stack, MQTT and Websocket

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

Automattic/mongoose

GitHubMongoDB object modeling designed to work in an asynchronous environment.

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

Python Package IndexEating all the snakes.

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

Crates.ioConvenient MongoDb Wrappers

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD

RubyGemsMongoose is a module that allows you to create and databases. It has an ActiveRecord-like interface, uses Skiplists for its indexing, and uses Marshal to serializeits data.

= *, < 6.13.6, >= 7.0.0, < 7.8.4, >= 8.0.0, < 8.9.5NVD