CVE-2026-125119
Description
A flaw was found in Mongoose. When the sanitizeFilter security option is configured at the connection level, query operations fail to evaluate and enforce the setting, leaving input filters unsanitized. A remote attacker can exploit this flaw by submitting crafted objects containing query operators, allowing them to bypass query restrictions and gain unauthorized access to sensitive data.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Enable filter sanitization globally at application initialization instead of passing it as a connection parameter, or apply sanitization explicitly to individual queries:
1. Configure global filter sanitization in application code:
`mongoose.set('sanitizeFilter', true);`
2. Alternatively, invoke sanitization directly on query instances:
`Model.find(query).sanitizeFilter();`
3. In addition, validate and sanitize untrusted input before using it in database queries to ensure keys containing query operators (such as keys beginning with '$') are rejected.
Caveats: Modifying application initialization or query logic requires restarting the affected application service. Thoroughly test global sanitization in non-production environments to ensure valid query operators are not unintentionally stripped.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
