CVE-2026-125120

Summary

Mongoose's countDocuments() function fails to sanitize attacker-controlled filter inputs when sanitizeFilter is enabled, allowing query operator injection. This lets attackers manipulate the count result by injecting operators like $gt or $ne as literal values, potentially bypassing authorization checks or business logic that relies on accurate document counts.

Exploitability

Exploitation requires an application to explicitly enable sanitizeFilter and pass unsanitized user input directly to countDocuments(); no authentication is needed if the endpoint is publicly exposed.

Blast radius

Successful exploitation could lead to unauthorized data access, privilege escalation via incorrect count-based authorization, or disruption of rate-limiting and quota enforcement mechanisms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Mongoose to version 6.13.11, 7.8.12, 8.24.3, or 9.9.2 (or later patch for the respective major line) immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.