Mongoose, the widely used MongoDB object modelling library for Node.js, has patched a critical flaw that left one of its query methods without a key defence against injection attacks. The vulnerability, tracked as CVE-2026-125120, carries the maximum-adjacent CVSS score of 9.8 and was published on Monday 9 November 2026.

The flaw sits in countDocuments(), the method applications use to count how many documents match a query. Mongoose ships a defence called sanitizeFilter, which strips query operators out of filter values so that attacker-supplied input is treated as literal text. According to the project's security advisory, countDocuments() did not apply that defence at all.

How the flaw works

An application that enables sanitizeFilter and passes attacker-controlled values into countDocuments() could therefore have those values processed as query operators rather than as plain values. The result is a count that includes documents which should not have matched the query.

That matters because counts are often used to make decisions. An application might check how many records match a user before granting access, or use a count to enforce a limit. If the count can be inflated by crafted input, the logic built on top of it can be undermined, including authorisation checks that depend on the result.

The advisory classifies the weakness as improper neutralisation of special elements in data query logic, recorded as CWE-943. It affects Mongoose versions before 6.13.11, 7.8.12, 8.24.3 and 9.9.2, covering every supported major release line.

What to do now

Fixed versions have been released for all four supported lines. Users should upgrade to 6.13.11, 7.8.12, 8.24.3 or 9.9.2, depending on which major version they run. The advisory notes that the fix is available now, and there is no indication in the published record that the flaw has been added to CISA's Known Exploited Vulnerabilities catalogue.

For teams that cannot upgrade immediately, the advisory offers a workaround. A Mongoose plugin can attach middleware that runs before every countDocuments() call and applies sanitizeFilter to the query filter by hand. The advisory gives sample code that registers a pre-hook on the schema and calls mongoose.sanitizeFilter on the filter before the query runs.

The disclosure is a reminder that a security control is only as strong as its coverage. sanitizeFilter was doing its job on other query methods, but countDocuments() had been missed, leaving a gap in applications that trusted the setting to protect every query. Developers who use countDocuments() with user-supplied filters should check their Mongoose version and upgrade, and review any authorisation or limit logic that relies on document counts.