{ "@id": "urn:uuid:aa9dde80-d46b-4428-b0c6-85ebfcf67d54", "role": "Document Creator", "author": "https://tuxcare.com", "version": 11, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T21:05:02.047764+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-04T09:01:00.133094+00:00", "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.6.1 of mongoose. not_affected \u2014 CVE-2019-17426 affects Mongoose through version 5.7.4 due to a bson 1.x parser issue where query objects with a `_bsontype` attribute would be ignored, allowing attackers to bypass access control filters. The vulnerability was fixed in upstream version 5.7.5 (2019-10-14) by adding a workaround that deletes `_bsontype` properties from query objects. Target version 9.6.1 uses MongoDB driver 7.2 w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17426" }, "impact_statement": "not_affected \u2014 CVE-2019-17426 affects Mongoose through version 5.7.4 due to a bson 1.x parser issue where query objects with a `_bsontype` attribute would be ignored, allowing attackers to bypass access control filters. The vulnerability was fixed in upstream version 5.7.5 (2019-10-14) by adding a workaround that deletes `_bsontype` properties from query objects. Target version 9.6.1 uses MongoDB driver 7.2 w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.6.1 of mongoose. not_affected \u2014 CVE-2022-24304 (Prototype Pollution in Schema.path()) is NOT present in mongoose 9.6.1. The vulnerability was fixed in upstream commit 6a1973165 (July 18, 2022) which added validation to reject special properties (__proto__, constructor, prototype) in the Schema.path() method. This fix was already included in the upstream release that TuxCare onboarded (fix is an ancestor of the first TuxCare c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24304" }, "impact_statement": "not_affected \u2014 CVE-2022-24304 (Prototype Pollution in Schema.path()) is NOT present in mongoose 9.6.1. The vulnerability was fixed in upstream commit 6a1973165 (July 18, 2022) which added validation to reject special properties (__proto__, constructor, prototype) in the Schema.path() method. This fix was already included in the upstream release that TuxCare onboarded (fix is an ancestor of the first TuxCare c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.6.1 of mongoose. not_affected \u2014 Mongoose v9.6.1 is not affected by CVE-2022-2564 (prototype pollution in Schema.path()). The vulnerable pattern was removed by upstream vendor fix commit 6a197316 (Valeri Karpov, July 18, 2022) which added validation rejecting dangerous property names (__proto__, constructor, prototype) when setting schema paths. This fix was already present in the upstream release when TuxCare onboarded the re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2564" }, "impact_statement": "not_affected \u2014 Mongoose v9.6.1 is not affected by CVE-2022-2564 (prototype pollution in Schema.path()). The vulnerable pattern was removed by upstream vendor fix commit 6a197316 (Valeri Karpov, July 18, 2022) which added validation rejecting dangerous property names (__proto__, constructor, prototype) when setting schema paths. This fix was already present in the upstream release when TuxCare onboarded the re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.6.1 of mongoose. not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect version 9.6.1. The vulnerability was fixed in upstream mongoose versions 7.3.3, 6.11.3, and 5.13.20 (July 2023). The target version 9.6.1 is significantly newer and already contains the upstream fix. The fix (commit e29578d2e by Valeri Karpov) was shipped in the upstream release before TuxCare onboarded this project. The vulnerable...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-3696" }, "impact_statement": "not_affected \u2014 CVE-2023-3696 (Prototype Pollution in mongoose) does not affect version 9.6.1. The vulnerability was fixed in upstream mongoose versions 7.3.3, 6.11.3, and 5.13.20 (July 2023). The target version 9.6.1 is significantly newer and already contains the upstream fix. The fix (commit e29578d2e by Valeri Karpov) was shipped in the upstream release before TuxCare onboarded this project. The vulnerable..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-02T20:06:00.090260+00:00", "status_notes": "Vulnerability CVE-2024-53900 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2024-53900" }, "action_statement": "Vulnerability CVE-2024-53900 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2025-23061 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2025-23061" }, "action_statement": "Vulnerability CVE-2025-23061 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-10T21:05:02.047764+00:00", "status_notes": "Vulnerability CVE-2026-125116 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-125116" }, "action_statement": "Vulnerability CVE-2026-125116 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-10T21:05:02.047764+00:00", "status_notes": "Vulnerability CVE-2026-125117 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-125117" }, "action_statement": "Vulnerability CVE-2026-125117 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-10T20:58:50.437512+00:00", "status_notes": "Vulnerability CVE-2026-125118 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-125118" }, "action_statement": "Vulnerability CVE-2026-125118 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-10T20:03:31.902906+00:00", "status_notes": "Vulnerability CVE-2026-125119 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-125119" }, "action_statement": "Vulnerability CVE-2026-125119 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-10T19:43:34.920122+00:00", "status_notes": "Vulnerability CVE-2026-125120 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-125120" }, "action_statement": "Vulnerability CVE-2026-125120 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2026-42334 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-42334" }, "action_statement": "Vulnerability CVE-2026-42334 affects version 9.6.1 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-10-18T15:42:00.099414+00:00", "status_notes": "Vulnerability CVE-2026-73562 affects version 9.6.1 of mongoose.", "vulnerability": { "name": "CVE-2026-73562" }, "action_statement": "Vulnerability CVE-2026-73562 affects version 9.6.1 of mongoose." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.6.1", "identifiers": { "purl": "pkg:npm/mongoose@9.6.1" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.6.1 of mongoose. not_affected \u2014 Target version 9.6.1 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability was fixed by upstream mongoose maintainer Valeri Karpov in commit 8066b145c on January 15, 2016, and released in versions 4.3.6 and 3.8.39. The fix prevents allocation of uninitialized memory by wrapping number values in arrays before Buffer conversion. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-r5xw-q988-826m" }, "impact_statement": "not_affected \u2014 Target version 9.6.1 is NOT affected by GHSA-r5xw-q988-826m (remote memory exposure via uninitialized Buffer allocation). The vulnerability was fixed by upstream mongoose maintainer Valeri Karpov in commit 8066b145c on January 15, 2016, and released in versions 4.3.6 and 3.8.39. The fix prevents allocation of uninitialized memory by wrapping number values in arrays before Buffer conversion. The..." } ] }