automattic mongoose Vulnerabilities: CVEs, CISA KEV & Security Advisories

Severity and exploitation

How the CVSS severity of automattic mongoose's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical3

High2

Medium0

Low0

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

None of automattic mongoose's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2 of automattic mongoose's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every automattic mongoose version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

5.13.173 CVEs
6.10.23 CVEs
6.10.33 CVEs
6.10.43 CVEs
6.10.53 CVEs
6.11.03 CVEs
6.11.13 CVEs
6.11.23 CVEs
6.11.33 CVEs
6.10.12 CVEs
6.11.42 CVEs
6.11.52 CVEs
6.11.62 CVEs
6.12.02 CVEs
6.12.12 CVEs
6.12.22 CVEs
6.12.42 CVEs
6.12.52 CVEs
6.12.62 CVEs
6.12.72 CVEs
6.12.82 CVEs
6.12.92 CVEs
6.13.02 CVEs
6.13.12 CVEs
6.13.22 CVEs
6.13.32 CVEs
6.13.42 CVEs
7.0.02 CVEs
7.0.12 CVEs
7.0.22 CVEs
7.0.32 CVEs
7.0.42 CVEs
7.0.52 CVEs
7.1.02 CVEs
7.1.12 CVEs
7.1.22 CVEs
7.2.02 CVEs
7.2.12 CVEs
7.2.22 CVEs
7.2.32 CVEs
7.2.42 CVEs
7.3.02 CVEs
7.3.12 CVEs
7.3.22 CVEs
7.3.32 CVEs
< 6.13.91 CVE
>= 7.0.0, <= 7.8.81 CVE
>= 8.0.0, <= 8.22.01 CVE
>= 9.0.0, <= 9.1.51 CVE
0.0.11 CVE
0.0.21 CVE
0.0.31 CVE
0.0.41 CVE
0.0.51 CVE
1.0.11 CVE
1.0.101 CVE
1.0.111 CVE
1.0.121 CVE
1.0.131 CVE
1.0.141 CVE
1.0.151 CVE
1.0.161 CVE
1.0.21 CVE
1.0.31 CVE
1.0.41 CVE
1.0.51 CVE
1.0.61 CVE
1.0.71 CVE
1.0.81 CVE
1.0.91 CVE
1.1.01 CVE
1.1.11 CVE
1.1.101 CVE
1.1.111 CVE
1.1.121 CVE
1.1.131 CVE
1.1.141 CVE
1.1.151 CVE
1.1.161 CVE
1.1.171 CVE
1.1.181 CVE
1.1.191 CVE
1.1.21 CVE
1.1.201 CVE
1.1.211 CVE
1.1.221 CVE
1.1.231 CVE
1.1.251 CVE
1.1.31 CVE
1.1.41 CVE
1.1.51 CVE
1.1.61 CVE
1.1.71 CVE
1.1.81 CVE
1.1.91 CVE
1.3.01 CVE
1.3.11 CVE
1.3.21 CVE
1.3.31 CVE
1.3.41 CVE
1.3.51 CVE
1.3.61 CVE
1.3.71 CVE
1.4.01 CVE
1.5.01 CVE
1.6.01 CVE
1.7.21 CVE
2.0.01 CVE
2.0.11 CVE
2.0.21 CVE
2.0.31 CVE
2.0.41 CVE
2.1.01 CVE
2.1.11 CVE
2.1.21 CVE
2.1.31 CVE
2.1.41 CVE
2.2.01 CVE
2.2.11 CVE
2.2.21 CVE
2.2.31 CVE
2.2.41 CVE
2.3.01 CVE
2.3.11 CVE
2.3.101 CVE
2.3.111 CVE
2.3.121 CVE
2.3.131 CVE
2.3.21 CVE
2.3.31 CVE
2.3.41 CVE
2.3.51 CVE
2.3.61 CVE
2.3.71 CVE
2.3.81 CVE
2.3.91 CVE
2.4.01 CVE
2.4.11 CVE
2.4.101 CVE
2.4.21 CVE
2.4.31 CVE
2.4.41 CVE
2.4.51 CVE
2.4.61 CVE
2.4.71 CVE
2.4.81 CVE
2.4.91 CVE
2.5.01 CVE
2.5.11 CVE
2.5.101 CVE
2.5.111 CVE
2.5.121 CVE
2.5.131 CVE
2.5.21 CVE
2.5.31 CVE
2.5.41 CVE
2.5.51 CVE
2.5.61 CVE
2.5.71 CVE
2.5.81 CVE
2.5.91 CVE
3.0.01 CVE
3.0.0alpha11 CVE
3.0.0alpha21 CVE
3.0.0rc01 CVE
3.0.11 CVE
3.0.21 CVE
3.0.31 CVE
3.1.01 CVE
3.1.11 CVE
3.1.21 CVE
3.2.01 CVE
3.2.11 CVE
3.2.21 CVE
3.3.01 CVE
3.3.11 CVE
3.4.01 CVE
3.5.01 CVE
3.5.11 CVE
3.5.21 CVE
3.5.41 CVE
3.5.51 CVE
3.5.61 CVE
3.5.71 CVE
3.6.01 CVE
3.6.0rc11 CVE
3.6.11 CVE
3.6.21 CVE
3.6.31 CVE
3.6.41 CVE
3.7.21 CVE
3.7.31 CVE
3.7.41 CVE
3.8.01 CVE
3.8.11 CVE
3.8.101 CVE
3.8.111 CVE
3.8.121 CVE
3.8.131 CVE
3.8.141 CVE
3.8.151 CVE
3.8.161 CVE
3.8.171 CVE
3.8.181 CVE
3.8.191 CVE
3.8.21 CVE
3.8.201 CVE
3.8.211 CVE
3.8.221 CVE
3.8.231 CVE
3.8.241 CVE
3.8.251 CVE
3.8.261 CVE
3.8.271 CVE
3.8.281 CVE
3.8.291 CVE
3.8.31 CVE
3.8.301 CVE
3.8.311 CVE
3.8.321 CVE
3.8.331 CVE
3.8.341 CVE
3.8.351 CVE
3.8.361 CVE
3.8.371 CVE
3.8.381 CVE
3.8.391 CVE
3.8.41 CVE
3.8.401 CVE
3.8.51 CVE
3.8.61 CVE
3.8.71 CVE
3.8.81 CVE
3.8.91 CVE
3.9.01 CVE
3.9.11 CVE
3.9.21 CVE
3.9.31 CVE
3.9.41 CVE
3.9.51 CVE
3.9.61 CVE
3.9.71 CVE
4.0.01 CVE
4.0.0-rc01 CVE
4.0.0-rc11 CVE
4.0.0-rc21 CVE
4.0.0-rc31 CVE
4.0.0-rc41 CVE
4.0.11 CVE
4.0.21 CVE
4.0.31 CVE
4.0.41 CVE
4.0.51 CVE
4.0.61 CVE
4.0.71 CVE
4.0.81 CVE
4.1.01 CVE
4.1.11 CVE
4.1.101 CVE
4.1.111 CVE
4.1.121 CVE
4.1.21 CVE
4.1.31 CVE
4.1.41 CVE
4.1.51 CVE
4.1.61 CVE
4.1.71 CVE
4.1.81 CVE
4.1.91 CVE
4.10.01 CVE
4.10.11 CVE
4.10.21 CVE
4.10.31 CVE
4.10.41 CVE
4.10.51 CVE
4.10.61 CVE
4.10.71 CVE
4.10.81 CVE
4.11.01 CVE
4.11.11 CVE
4.11.111 CVE
4.11.121 CVE
4.11.131 CVE
4.11.141 CVE
4.11.21 CVE
4.11.31 CVE
4.11.41 CVE
4.11.51 CVE
4.11.61 CVE
4.11.71 CVE
4.11.81 CVE
4.11.91 CVE
4.12.01 CVE
4.12.11 CVE
4.12.21 CVE
4.12.31 CVE
4.12.41 CVE
4.12.51 CVE
4.12.61 CVE
4.13.01 CVE
4.13.11 CVE
4.13.101 CVE
4.13.111 CVE
4.13.121 CVE
4.13.131 CVE
4.13.141 CVE
4.13.171 CVE
4.13.181 CVE
4.13.191 CVE
4.13.21 CVE
4.13.31 CVE
4.13.41 CVE
4.13.51 CVE
4.13.61 CVE
4.13.71 CVE
4.13.81 CVE
4.2.01 CVE
4.2.11 CVE
4.2.101 CVE
4.2.31 CVE
4.2.41 CVE
4.2.51 CVE
4.2.61 CVE
4.2.71 CVE
4.2.81 CVE
4.2.91 CVE
4.3.01 CVE
4.3.11 CVE
4.3.21 CVE
4.3.31 CVE
4.3.41 CVE
4.3.51 CVE
4.3.61 CVE
4.3.71 CVE
4.4.01 CVE
4.4.11 CVE
4.4.101 CVE
4.4.111 CVE
4.4.121 CVE
4.4.131 CVE
4.4.141 CVE
4.4.151 CVE
4.4.161 CVE
4.4.171 CVE
4.4.181 CVE
4.4.191 CVE
4.4.21 CVE
4.4.201 CVE
4.4.31 CVE
4.4.41 CVE
4.4.51 CVE
4.4.61 CVE
4.4.71 CVE
4.4.81 CVE
4.4.91 CVE
4.5.01 CVE
4.5.11 CVE
4.5.21 CVE
4.5.31 CVE
4.5.41 CVE
4.5.51 CVE
4.5.61 CVE
4.5.71 CVE
4.5.81 CVE
4.5.91 CVE
4.6.01 CVE
4.6.11 CVE
4.6.21 CVE
4.6.31 CVE
4.6.41 CVE
4.6.51 CVE
4.6.61 CVE
4.6.71 CVE
4.6.81 CVE
4.7.01 CVE
4.7.11 CVE
4.7.21 CVE
4.7.31 CVE
4.7.41 CVE
4.7.51 CVE
4.7.61 CVE
4.7.71 CVE
4.7.81 CVE
4.7.91 CVE
4.8.01 CVE
4.8.11 CVE
4.8.21 CVE
4.8.31 CVE
4.8.41 CVE
4.8.51 CVE
4.8.61 CVE
4.8.71 CVE
4.9.01 CVE
4.9.11 CVE
4.9.101 CVE
4.9.21 CVE
4.9.31 CVE
4.9.41 CVE
4.9.51 CVE
4.9.61 CVE
4.9.71 CVE
4.9.81 CVE
4.9.91 CVE
5.0.01 CVE
5.0.0-rc01 CVE
5.0.0-rc11 CVE
5.0.0-rc21 CVE
5.0.11 CVE
5.0.101 CVE
5.0.111 CVE
5.0.121 CVE
5.0.131 CVE
5.0.141 CVE
5.0.151 CVE
5.0.161 CVE
5.0.171 CVE
5.0.181 CVE
5.0.21 CVE
5.0.31 CVE
5.0.41 CVE
5.0.51 CVE
5.0.61 CVE
5.0.71 CVE
5.0.81 CVE
5.0.91 CVE
5.1.01 CVE
5.1.11 CVE
5.1.21 CVE
5.1.31 CVE
5.1.41 CVE
5.1.51 CVE
5.1.61 CVE
5.1.71 CVE
5.1.81 CVE
5.13.101 CVE
5.13.111 CVE
5.13.121 CVE
5.13.131 CVE
5.13.141 CVE
5.13.91 CVE
5.2.01 CVE
5.2.11 CVE
5.2.101 CVE
5.2.121 CVE
5.2.131 CVE
5.2.141 CVE
5.2.151 CVE
5.2.161 CVE
5.2.171 CVE
5.2.181 CVE
5.2.21 CVE
5.2.31 CVE
5.2.41 CVE
5.2.51 CVE
5.2.61 CVE
5.2.71 CVE
5.2.81 CVE
5.3.01 CVE
5.3.11 CVE
5.3.101 CVE
5.3.111 CVE
5.3.121 CVE
5.3.141 CVE
5.3.151 CVE
5.3.161 CVE
5.3.21 CVE
5.3.31 CVE
5.3.41 CVE
5.3.51 CVE
5.3.61 CVE
5.3.71 CVE
5.3.81 CVE
5.4.01 CVE
5.4.11 CVE
5.4.101 CVE
5.4.111 CVE
5.4.121 CVE
5.4.131 CVE
5.4.141 CVE
5.4.151 CVE
5.4.161 CVE
5.4.171 CVE
5.4.181 CVE
5.4.191 CVE
5.4.21 CVE
5.4.201 CVE
5.4.211 CVE
5.4.221 CVE
5.4.231 CVE
5.4.31 CVE
5.4.41 CVE
5.4.51 CVE
5.4.61 CVE
5.4.71 CVE
5.4.81 CVE
5.4.91 CVE
5.5.01 CVE
5.5.11 CVE
5.5.101 CVE
5.5.111 CVE
5.5.121 CVE
5.5.131 CVE
5.5.141 CVE
5.5.151 CVE
5.5.21 CVE
5.5.31 CVE
5.5.41 CVE
5.5.51 CVE
5.5.61 CVE
5.5.71 CVE
5.5.81 CVE
5.5.91 CVE
5.6.01 CVE
5.6.11 CVE
5.6.101 CVE
5.6.111 CVE
5.6.121 CVE
5.6.131 CVE
5.6.21 CVE
5.6.31 CVE
5.6.41 CVE
5.6.51 CVE
5.6.61 CVE
5.6.71 CVE
5.6.81 CVE
5.6.91 CVE
5.7.01 CVE
5.7.11 CVE
5.7.21 CVE
5.7.31 CVE
5.7.41 CVE
6.0.01 CVE
6.0.11 CVE
6.0.101 CVE
6.0.111 CVE
6.0.121 CVE
6.0.131 CVE
6.0.141 CVE
6.0.151 CVE
6.0.21 CVE
6.0.31 CVE
6.0.41 CVE
6.0.51 CVE
6.0.61 CVE
6.0.71 CVE
6.0.81 CVE
6.0.91 CVE
6.1.01 CVE
6.1.11 CVE
6.1.101 CVE
6.1.21 CVE
6.1.31 CVE
6.1.41 CVE
6.1.51 CVE
6.1.61 CVE
6.1.71 CVE
6.1.81 CVE
6.1.91 CVE
6.13.51 CVE
6.2.01 CVE
6.2.11 CVE
6.2.101 CVE
6.2.111 CVE
6.2.21 CVE
6.2.31 CVE
6.2.41 CVE
6.2.51 CVE
6.2.61 CVE
6.2.71 CVE
6.2.81 CVE
6.2.91 CVE
6.3.01 CVE
6.3.11 CVE
6.3.21 CVE
6.3.31 CVE
6.3.41 CVE
6.3.51 CVE
6.3.61 CVE
6.3.71 CVE
6.3.81 CVE
6.3.91 CVE
6.4.01 CVE
6.4.11 CVE
6.4.21 CVE
6.4.31 CVE
6.4.41 CVE
6.4.51 CVE
7.3.41 CVE
7.4.01 CVE
7.4.11 CVE
7.4.21 CVE
7.4.31 CVE
7.4.41 CVE
7.4.51 CVE
7.5.01 CVE
7.5.11 CVE
7.5.21 CVE
7.5.31 CVE
7.5.41 CVE
7.6.01 CVE
7.6.11 CVE
7.6.101 CVE
7.6.111 CVE
7.6.121 CVE
7.6.131 CVE
7.6.21 CVE
7.6.31 CVE
7.6.41 CVE
7.6.51 CVE
7.6.61 CVE
7.6.71 CVE
7.6.81 CVE
7.6.91 CVE
7.7.01 CVE
7.8.01 CVE
7.8.11 CVE
7.8.21 CVE
8.0.01 CVE
8.0.0-rc01 CVE
8.0.11 CVE
8.0.21 CVE
8.0.31 CVE
8.0.41 CVE
8.1.01 CVE
8.1.11 CVE
8.1.21 CVE
8.1.31 CVE
8.2.01 CVE
8.2.11 CVE
8.2.21 CVE
8.2.31 CVE
8.2.41 CVE
8.3.01 CVE
8.3.11 CVE
8.3.21 CVE
8.3.31 CVE
8.3.41 CVE
8.3.51 CVE
8.4.01 CVE
8.4.11 CVE
8.4.21 CVE
8.4.31 CVE
8.4.41 CVE
8.4.51 CVE
8.5.01 CVE
8.5.11 CVE
8.5.21 CVE
8.5.31 CVE
8.5.41 CVE
8.5.51 CVE
8.6.01 CVE
8.6.11 CVE
8.6.21 CVE
8.6.31 CVE
8.6.41 CVE
8.7.01 CVE
8.7.11 CVE
8.7.21 CVE
8.7.31 CVE
8.8.01 CVE
8.8.11 CVE
8.8.21 CVE
test1 CVE
v4.11.131 CVE

Fixed in

0cb0757a53c7ca4eb27753ef68c5f631e7c03a531 CVE
15bdccf78ca96c85038346c2ceccb934b1c54f401 CVE
5449ab9e51a779a889b3751416bab1480630b0371 CVE
5af0a109fcf206eb765c02e0fffe54a78ab951741 CVE
64a9f9706f2428c49e0cfb8e223065acc645f7bc1 CVE
73e81abe3ec012f8255d3ca9978594075378faf41 CVE
8.8.31 CVE
bb98dcf859b2cf0cc7da9d16d9d09afe445321f31 CVE
c79a922e451a0c5b894f0e6917c63fef4c237f4b1 CVE
c9e86bff7eef477da75a29af62a06d41a835a1561 CVE
e59e342e5d01bfeee31c5d5c796745315ecf0fa91 CVE

Find a version

6 CVEs

Sort

Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
CVE-2026-42334
Patch
CWE-74
High · CVSS 7.5
EPSS 0.0% (15th pct)2026-05-14
Critical vulnerability · 2025-01-15
CVE-2025-23061
Patch
CWE-94
Critical · CVSS 9.0
EPSS 55.3% (98th pct)2025-01-15
Critical vulnerability · 2024-12-02
CVE-2024-53900
Patch
CWE-89
Critical · CVSS 9.1
EPSS 52.2% (98th pct)2024-12-02
Prototype Pollution in automattic/mongoose
CVE-2023-3696
Public exploit
Patch
CWE-1321
Critical · CVSS 10.0
EPSS 0.5% (65th pct)2023-07-17
Prototype Pollution in automattic/mongoose
CVE-2022-2564
Public exploit
Patch
CWE-1321
High · CVSS 7.0
EPSS 2.9% (87th pct)2022-07-28
Vulnerability · 2019-10-10
CVE-2019-17426
Patch
Unscored
EPSS 0.2% (47th pct)2019-10-10

Severity and exploitation

automattic mongoose Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Fixed in

Common weakness types

Disclosure activity by year

Other automattic products

Frequently asked questions

How many CVEs does automattic mongoose have?

How many automattic mongoose CVEs are in CISA KEV?

Are there public exploits for automattic mongoose vulnerabilities?

Which versions of automattic mongoose are affected?

What are the most common weakness types in automattic mongoose CVEs?

How many critical automattic mongoose vulnerabilities are there?

What is the average severity of automattic mongoose CVEs?

References

Track automattic mongoose vulnerabilities