Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-42334— Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

Quick assessment

Affected
Automattic mongoose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mongoose是Automattic开源的一个 MongoDB 对象建模，旨在在异步环境中工作。 Mongoose 6.13.9之前版本、7.8.9之前版本、8.22.1之前版本和9.1.6之前版本存在注入漏洞，该漏洞源于通过$nor运算符绕过sanitizeFilter查询清理机制，当sanitizeFilter启用时，Mongoose将查询运算符包装在$eq中，但$nor未包含在递归清理的逻辑运算符集合中，导致恶意运算符如$ne、$gt或$regex可在$nor子句中注入而不被清理。

CVSS 7.5 · High EPSS 0.46% · P38

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

VendorProduct Version RangeStatus
Automattic mongoose < 6.13.9 affected
>= 7.0.0, <= 7.8.8 affected
>= 8.0.0, <= 8.22.0 affected
>= 9.0.0, <= 9.1.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-42334

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Source: CVE Program / CVE List V5
Vulnerability Description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Mongoose 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mongoose是Automattic开源的一个 MongoDB 对象建模，旨在在异步环境中工作。 Mongoose 6.13.9之前版本、7.8.9之前版本、8.22.1之前版本和9.1.6之前版本存在注入漏洞，该漏洞源于通过$nor运算符绕过sanitizeFilter查询清理机制，当sanitizeFilter启用时，Mongoose将查询运算符包装在$eq中，但$nor未包含在递归清理的逻辑运算符集合中，导致恶意运算符如$ne、$gt或$regex可在$nor子句中注入而不被清理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Automattic mongoose < 6.13.9 -

II. Public POCs for CVE-2026-42334

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42334

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-42334 (1)

IV. Related Vulnerabilities

Same product: mongoose
Same vendor: Automattic
Same weakness: CWE-74

V. Comments for CVE-2026-42334

No comments yet

Leave a comment