← Vulnerability feed

Vulnerability record · CVE-2019-17426 · published 10 October 2019

CVE-2019-17426: Mongoosejs mongoose vulnerability

Mongoosejs · Mongoose

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

9.1 CVSS 3.1 Critical EPSS 1.7% · top 24.3%
9.1CVSS 3.1 base score, v2 6.4
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c Patch
https://github.com/Automattic/mongoose/issues/8222 Third Party Advisory
https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c Patch
https://github.com/Automattic/mongoose/issues/8222 Third Party Advisory

Track CVE-2019-17426 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-23061Mongoosejs mongoose code injection vulnerabilityMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because…EPSS 7.3%9.8CVE-2023-3696Mongoosejs mongoose prototype pollution vulnerabilityPrototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.EPSS 1.2%9.8CVE-2022-2564Mongoosejs mongoose prototype pollution vulnerabilityPrototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.EPSS 33%9.1CVE-2024-53900Mongoosejs mongoose sql injection vulnerabilityMongoose before 8.8.3 can improperly use $where in match, leading to search injection.EPSS 4.0%7.5CVE-2026-42334Mongoosejs mongoose injection vulnerabilityMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerabilit…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2019-17426), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.