ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (mongoose)
Criticalnpm package (mongoose)

Mongoose 6 to 9: sanitizeFilter didn't protect some queries from injection, update now

Node.js developers whose apps use Mongoose with sanitizeFilter turned on to guard queries built from user input.

How to fix it

You haveUpdate to
< 6.13.12→6.13.12>= 7.0.0, < 7.8.13→7.8.13>= 8.0.0, < 8.24.7→8.24.7>= 9.0.0, < 9.11.4→9.11.4

Check your version

Which version your project has
npm ls mongoose

Update

In your project
npm update mongoose
npm ls mongoose
Still old? A dependency pins it
npm explain mongoose
Then check what's left
npm audit

Both flaws break sanitizeFilter, the option that stops query injection like a password of { $ne: null }. countDocuments() skipped it, and turning it on in mongoose.connect() or createConnection() did nothing at all. Setting it with mongoose.set('sanitizeFilter') or per query wasn't hit by the second flaw. The versions listed here fix both.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources