`mongoose`

Ecosystem:
npm

Package URL:
pkg:npm/mongoose

Total PRs:
8,281 Dependabot PRs

Latest PR:
4 days ago

Unique Repositories:
2,148 repositories

Unique Repos (30 days):
12 repositories

Security Advisories

Mongoose search injection vulnerability

GHSA-vg7j-7cwx-8wgw CVE-2025-23061 CRITICAL published over 1 year ago • updated 6 days ago

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the `$where` operator. This vulnerability arises from the abi...

automattic/mongoose vulnerable to Prototype pollution via Schema.path

GHSA-f825-f98c-gj3g CVE-2022-2564 HIGH published almost 4 years ago • updated 18 days ago

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Pro...

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

GHSA-wpg9-53fq-2r8h CVE-2026-42334 HIGH published 3 months ago • updated 2 days ago

### Impact This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator. When sanitizeFilte...

Mongoose Prototype Pollution vulnerability

GHSA-9m93-w8w6-76hh CVE-2023-3696 CRITICAL published about 3 years ago • updated 6 days ago

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

Remote Memory Exposure in mongoose

GHSA-r5xw-q988-826m MODERATE published almost 6 years ago • updated 6 days ago

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the aff...

View all 9 advisories

Recent PRs

RSS Feed

fix(deps): bump mongoose from 9.7.4 to 9.8.0

rstar327/exam-proctoring-with-tensorflow #243

9.7.4 → 9.8.0 Minor PR

Open 4 days ago 1 comment

build(deps): bump the non-major-dependencies group across 1 directory with 45 updates

emilhornlund/klurigo #499

9.7.0 → 9.7.4 Patch PR

Closed 17 days ago 1 comment

chore(deps): bump mongoose from 8.24.1 to 9.7.4

fwfindia/FWF #12

8.24.1 → 9.7.4 Major PR

Open 17 days ago 1 comment

chore(deps): bump mongoose from 8.24.1 to 9.7.3

RAYHAN-HEXA/Property-Rental-Booking-Platform-server #2

8.24.1 → 9.7.3 Major PR

Open 19 days ago 1 comment

build(deps): bump the dependencies group with 41 updates

ahmedchoudery/Stop-Shop #4

8.23.0 → 9.7.3 Major PR

Open 21 days ago 1 comment

Bump mongoose from 9.6.2 to 9.7.3 in /wts-cms in the api-runtime group

Webskitters-Technology-Solutions/WS-CMS #61

9.6.2 → 9.7.3 Minor PR

Open 23 days ago 1 comment

chore(deps): bump mongoose from 8.24.1 to 9.7.3

reiorozco/vidly-api #19

8.24.1 → 9.7.3 Major PR

Closed 24 days ago 3 comments

build(deps): bump the prod-dependencies group across 1 directory with 18 updates

mountogdengc/homebrewery #63

9.6.2 → 9.7.3 Minor PR

Closed 25 days ago 1 comment

Bump mongoose from 9.6.1 to 9.7.3

barnakun/server-side-js #23

9.6.1 → 9.7.3 Minor PR

Closed 26 days ago 3 comments

npm: bump mongoose from 8.0.1 to 9.7.3

samiwarraich/shopit #797

8.0.1 → 9.7.3 Major PR

Open 29 days ago 1 comment

chore(deps): bump the dependencies group across 1 directory with 20 updates

soumyadeepsarkar-2004/SarkarBrothers #19

9.4.1 → 9.7.2 Minor PR

Open about 1 month ago 1 comment

chore(deps): bump mongoose from 8.20.0 to 8.22.1

dobeutech/dobeucloud #63

8.20.0 → 8.22.1 Minor PR

Open about 1 month ago 2 comments

Bump mongoose from 9.6.3 to 9.7.2

aguscuuuu/backend #31

9.6.3 → 9.7.2 Minor PR

Closed about 1 month ago 1 comment

build(deps): bump the server-production-dependencies group across 1 directory with 15 updates

auntiehomie/bankbud #5

8.23.0 → 9.7.1 Major PR

Open about 1 month ago 2 comments

chore(deps): bump the all-dependencies group across 1 directory with 10 updates

krealalejo/hearthstone #5

9.6.3 → 9.7.1 Minor PR

Open about 1 month ago 1 comment

chore(deps)(deps): bump the all-packages group across 1 directory with 54 updates

ofri-peretz/eslint #202

9.6.3 → 9.7.1 Minor PR

Open about 1 month ago 4 comments

chore(deps): bump the minor-and-patch group with 27 updates

denizlg24/denizlg24.com #12

9.7.0 → 9.7.1 Patch PR

Open about 1 month ago 4 comments

Bump mongoose from 9.6.3 to 9.7.1

SallaApp/express-starter-kit #359

9.6.3 → 9.7.1 Minor PR

Closed about 1 month ago 2 comments

deps(deps): bump the minor-and-patch group across 1 directory with 15 updates

imRahul05/mansarovar_public_school #43

8.23.1 → 8.24.0 Minor PR

Open about 1 month ago 2 comments

npm(deps): bump mongoose from 9.6.3 to 9.7.0

Chloemlla/Happy-TTS #783

9.6.3 → 9.7.0 Minor PR

Closed about 1 month ago 4 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates

theunstopabble/TexFolio #5

8.21.1 → 8.22.1 Minor PR

Open about 1 month ago 1 comment

build(deps): bump the prod-dependencies group across 1 directory with 19 updates

mountogdengc/homebrewery #54

9.6.2 → 9.7.0 Minor PR

Closed about 1 month ago 1 comment

chore(deps): bump the production-dependencies group with 11 updates

jasonguijo-vienovo/vienovo-forms #369

9.6.1 → 9.6.3 Patch PR

Open about 2 months ago 2 comments

chore(deps): bump mongoose from 8.24.0 to 9.6.3

seabornlee/ai-english-dictionary #10

8.24.0 → 9.6.3 Major PR

Open about 2 months ago 2 comments

deps(deps): bump the minor-and-patch group across 1 directory with 14 updates

imRahul05/mansarovar_public_school #42

8.23.1 → 8.24.0 Minor PR

Open about 2 months ago 2 comments

Bump the version-minor-and-patch group across 2 directories with 7 updates

SerhatSoruklu/chatpdm #116

9.3.3 → 9.6.3 Minor PR

Open about 2 months ago 2 comments

deps: bump the posts-service-dependencies group across 1 directory with 4 updates

fairbanksio/f5news #260

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 1 comment

Bump mongoose from 8.16.4 to 9.6.3 in /server

Sumwanyuno/Zeroly #71

8.16.4 → 9.6.3 Major PR

Open about 2 months ago 1 comment

chore(deps): bump the minor-and-patch group across 1 directory with 19 updates

sbalbuenaSeat/wind-tunnel-registry-backend #33

9.3.3 → 9.6.3 Minor PR

Closed about 2 months ago 1 comment

deps: bump mongoose from 7.8.9 to 9.6.3

Bochorn0/aquatech-api #33

7.8.9 → 9.6.3 Major PR

Open about 2 months ago 1 comment

Bump mongoose from 9.6.2 to 9.6.3

shivam-verma-19/wms-api #50

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 1 comment

Bump mongoose from 8.19.1 to 8.22.1

goni715/triplem-backend #3

8.19.1 → 8.22.1 Minor PR

Open about 2 months ago 1 comment

build(deps): bump the production group with 2 updates

jjuanrivvera/daily-text-epub-to-json #114

9.6.2 → 9.6.3 Patch PR

Open about 2 months ago 1 comment

deps(engine): bump mongoose from 9.6.2 to 9.6.3 in the database-clients group

underpostnet/engine #87

9.6.2 → 9.6.3 Patch PR

Open about 2 months ago 2 comments

Bump mongoose from 9.6.1 to 9.6.3

pquirosv/concurso #73

9.6.1 → 9.6.3 Patch PR

Closed about 2 months ago 1 comment

chore: bump the minor-and-patch group across 1 directory with 19 updates

randy-rebucas/wise-foundation #6

9.4.1 → 9.6.3 Minor PR

Closed about 2 months ago 3 comments

Bump mongoose from 5.9.14 to 6.13.9

bryanprimus/taskmanager-api #34

5.9.14 → 6.13.9 Major PR

Closed about 2 months ago 1 comment

Bump mongoose from 9.3.3 to 9.6.3 in /server

chinmayahaha/mern-ai-boilerplate #14

9.3.3 → 9.6.3 Minor PR

Closed about 2 months ago 1 comment

chore(deps): bump the production-minor-patch group across 1 directory with 6 updates

Dhanush1376/EventDecor #19

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 3 comments

build(deps): bump mongoose from 9.3.3 to 9.6.3 in /server

chinmayahaha/donut #19

9.3.3 → 9.6.3 Minor PR

Open about 2 months ago 1 comment

build(deps): bump the all-minor-patch group across 1 directory with 8 updates

ardatan/graphql-mesh #9512

9.6.2 → 9.6.3 Patch PR

Open about 2 months ago 3 comments

Bump the npm_and_yarn group across 15 directories with 12 updates

XavierMP14/RUN #63

6.12.0 → 6.13.9 Minor PR

Closed about 2 months ago 1 comment

chore(deps)(deps): bump the all-packages group across 1 directory with 39 updates

ofri-peretz/eslint #142

9.6.2 → 9.6.3 Patch PR

Open about 2 months ago 4 comments

Bump the prod-dependencies group across 1 directory with 14 updates

datdamnzotz/homebrewery #1419

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 1 comment

Bump mongoose from 9.6.2 to 9.6.3

kere-sifon/african-stores-web #11

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 3 comments

Bump mongoose from 9.6.2 to 9.6.3

infinite-kube/Dependabot-Auto-Merge-Pipeline-Demo #551

9.6.2 → 9.6.3 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the dependencies group with 78 updates

Angelqg01/bez-digital-ecosystem #27

8.23.0 → 9.6.3 Major PR

Open about 2 months ago 2 comments

Bump the npm_and_yarn group across 5 directories with 25 updates

imagelessthought/overleaf #32

8.9.5 → 8.22.1 Minor PR

Closed about 2 months ago 1 comment

fix(deps): bump mongoose from 7.8.9 to 9.6.2 in /backend

Mersaal8484/FuelTrack-PEC #2

7.8.9 → 9.6.2 Major PR

Closed 2 months ago 2 comments

build(deps): bump mongoose from 8.6.2 to 8.22.1

ParindaTechInnovateprivatelimited/Mithila-Brothers_backend #2

8.6.2 → 8.22.1 Minor PR

Closed 2 months ago 1 comment

Package Details

Name:	`mongoose`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/mongoose`
JSON API:	View JSON

Security Advisories

9

Active advisories

CRITICAL 4

HIGH 3

MODERATE 2

View All npm Advisories

Package Information

Description:

Mongoose MongoDB ODM

Repository:	https://github.com/Automattic/mongoose
Homepage:	https://mongoosejs.com
Latest Release:	`8.15.0` about 1 year ago
Dependent Repos:	833,560
Dependent Packages:	13,842
Downloads:	13,007,275
Ranking:	Top 0.0397% by dependent repos Top 0.0991% by downloads Top 0.0081% by dependent pkgs

PR Status

Open 3,178 (38.4%)

Merged 1,408 (17.0%)

Closed 2,959 (35.7%)

PR Types

Major 1,470 (17.8%)

Minor 4,061 (49.0%)

Patch 2,009 (24.3%)

Removal 4 (0.0%)