Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-125116— Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

Quick assessment

Affected
Automattic mongoose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mongoose 是一款专为异步环境设计的 MongoDB 对象建模工具。在版本 6.13.12、7.8.13、8.24.7 和 9.11.4 之前，Mongoose 在索引普通对象注册表（如 和 ）时，会直接使用攻击者可控的鉴别器（discriminator）键值（包括默认的 字段），且未要求该键必须是对象自身的属性（own property）。因此，诸如 、 或 等键值可能解析为继承自原型链的内置函数，而非已注册的鉴别器，从而在模型构建、文档创建、数据水合（hydration）、查询与更新的类型转换、嵌入式鉴别

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-125116

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
Source: CVE Program / CVE List V5
Vulnerability Description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Automattic mongoose < 6.13.12 -

II. Public POCs for CVE-2026-125116

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-125116

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-125116 (5)

Vendor Advisories for CVE-2026-125116 (1)

Vendor Pages for CVE-2026-125116 (4)

Same Patch Batch · Automattic · 2026-11-09 · 5 CVEs total

CVE-2026-125120 9.8 CRITICAL Mongoose: sanitizeFilter not applied on countDocuments
CVE-2026-125117 8.2 HIGH Mongoose walks into inherited properties when hydrating, setting, and merging, allowing ov
CVE-2026-125119 7.5 HIGH Mongoose: Connection-level sanitizeFilter not applied
CVE-2026-125118 6.5 MEDIUM Mongoose: Prototype pollution via Schema.prototype.virtual()

IV. Related Vulnerabilities

Same product: mongoose
Same vendor: Automattic
Same weakness: CWE-843