Mongoose sanitizeFilter Bypass on countDocuments (CVE-2026-125120)

CVE-2026-125120 is a gap in sanitizeFilter, Mongoose's own defense against query-operator injection. Mongoose is an object modeling tool that Node.js applications use to work with MongoDB.

The GitHub advisory says sanitizeFilter was not applied to the countDocuments() method in the affected releases. sanitizeFilter normally strips MongoDB query operators out of a filter object before it reaches the database, so a caller-supplied value is read as literal data rather than as query logic.

What the Flaw Lets an Attacker Do

The CVE record says an application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() processes those values as query operators rather than literal values. The count that comes back can then include documents that should not match the intended filter.

The record adds that this can undermine authorization or application logic that depends on that count. One example is a check that uses a document count to decide whether a record exists or an action is allowed. We leave the filter values that trigger this behavior out of this page on purpose.

How the Score Reads

GitHub, the CNA, scores it CVSS 3.1 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. See our CVSS glossary entry for how to read that vector. NVD lists the same score from GitHub as a secondary source and shows the record's status as Received, meaning NVD has not yet published its own analysis. There is no CVSS 4.0 score in the record or NVD.

The CVE record assigns CWE-943, Improper Neutralization of Special Elements in Data Query Logic. The advisory's own GitHub page lists no CWE for the issue.

What the Advisory and CISA KEV Say

Neither the GitHub advisory nor the CVE record states whether the flaw has been exploited. As of CISA catalog version 2026.11.09, the CVE is not in our Known Exploited Vulnerabilities catalog.

The advisory also describes a workaround for applications that cannot upgrade immediately: a Mongoose middleware hook that runs sanitizeFilter on the countDocuments() filter before the query executes. See our vulnerability management guide for how to plan a rollout around a workaround like this.

The GitHub advisory and the CVE record give the same four affected ranges. Each range covers one major release line that was still supported when the fix shipped.

The advisory says patches exist for every supported major line, so an application upgrades within its current major version rather than across major versions. Mongoose is the standard object modeling layer for MongoDB in the Node.js ecosystem, so this fix reaches a large number of dependent applications at once.

GitHub credits koyokr as the reporter. The maintainer, vkarpov15, published the advisory, GHSA-pcrw-h46h-c93h, on 2 November 2026.