{ "@id": "urn:uuid:ec1bcf52-40d7-46d6-b8ab-04142246973f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T21:05:04.452255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2019-17426 does not affect version 9.7.2 of mongoose. not_affected \u2014 CVE-2019-17426 affects Mongoose \u22645.7.4 using old bson parsers (1.x-3.x) that ignore query filters with `_bsontype` properties. Target version 9.7.2 uses mongodb 7.2 (bundling bson 5.x+), which fixed this bug in 4.x. Mongoose added a workaround in Oct 2019 (f3eca5b94), then removed it in Jan 2022 (94570a640) after confirming bson 4.x+ is safe. The vulnerable bson parser code is not present in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17426" }, "impact_statement": "not_affected \u2014 CVE-2019-17426 affects Mongoose \u22645.7.4 using old bson parsers (1.x-3.x) that ignore query filters with `_bsontype` properties. Target version 9.7.2 uses mongodb 7.2 (bundling bson 5.x+), which fixed this bug in 4.x. Mongoose added a workaround in Oct 2019 (f3eca5b94), then removed it in Jan 2022 (94570a640) after confirming bson 4.x+ is safe. The vulnerable bson parser code is not present in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-24304 does not affect version 9.7.2 of mongoose. not_affected \u2014 CVE-2022-24304 (Mongoose prototype pollution via Schema.path()) is NOT present in target version 9.7.2. The vulnerable pattern was fixed by upstream commit a45cfb6b0 (authored by val@karpov.io) which added comprehensive validation to reject prototype chain accessors (__proto__, constructor, prototype) in path strings. This fix shipped in upstream version 6.4.6, well before the target version 9....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24304" }, "impact_statement": "not_affected \u2014 CVE-2022-24304 (Mongoose prototype pollution via Schema.path()) is NOT present in target version 9.7.2. The vulnerable pattern was fixed by upstream commit a45cfb6b0 (authored by val@karpov.io) which added comprehensive validation to reject prototype chain accessors (__proto__, constructor, prototype) in path strings. This fix shipped in upstream version 6.4.6, well before the target version 9...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-2564 does not affect version 9.7.2 of mongoose. not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function. The target repository (Mongoose 9.7.2) contains comprehensive defenses against this vulnerability, added in upstream commit 6a197316564742c0422309e1b5fecfa4faec126e (July 2022) by maintainer Valeri Karpov. The fix validates all path segments against reserved properties (__proto__, constructor, prot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2564" }, "impact_statement": "not_affected \u2014 CVE-2022-2564 describes a prototype pollution vulnerability in Mongoose's Schema.path() function. The target repository (Mongoose 9.7.2) contains comprehensive defenses against this vulnerability, added in upstream commit 6a197316564742c0422309e1b5fecfa4faec126e (July 2022) by maintainer Valeri Karpov. The fix validates all path segments against reserved properties (__proto__, constructor, prot..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2023-3696 does not affect version 9.7.2 of mongoose. not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in Mongoose affecting versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose v9.7.2, which is newer than the fixed version 7.3.3. The vulnerability allowed attackers to pollute Object.prototype by using MongoDB operators like $rename to create fields named __proto__ or constructor. The fix was introduced in upstream c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-3696" }, "impact_statement": "not_affected \u2014 CVE-2023-3696 is a prototype pollution vulnerability in Mongoose affecting versions prior to 7.3.3, 6.11.3, and 5.13.20. The target repository is Mongoose v9.7.2, which is newer than the fixed version 7.3.3. The vulnerability allowed attackers to pollute Object.prototype by using MongoDB operators like $rename to create fields named __proto__ or constructor. The fix was introduced in upstream c..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-02T20:06:00.090260+00:00", "status_notes": "Vulnerability CVE-2024-53900 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2024-53900" }, "action_statement": "Vulnerability CVE-2024-53900 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2025-23061 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2025-23061" }, "action_statement": "Vulnerability CVE-2025-23061 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-10T21:05:04.452255+00:00", "status_notes": "Vulnerability CVE-2026-125116 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-125116" }, "action_statement": "Vulnerability CVE-2026-125116 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-10T21:05:04.452255+00:00", "status_notes": "Vulnerability CVE-2026-125117 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-125117" }, "action_statement": "Vulnerability CVE-2026-125117 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-10T20:58:50.437512+00:00", "status_notes": "Vulnerability CVE-2026-125118 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-125118" }, "action_statement": "Vulnerability CVE-2026-125118 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-10T20:03:31.902906+00:00", "status_notes": "Vulnerability CVE-2026-125119 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-125119" }, "action_statement": "Vulnerability CVE-2026-125119 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-10T19:43:34.920122+00:00", "status_notes": "Vulnerability CVE-2026-125120 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-125120" }, "action_statement": "Vulnerability CVE-2026-125120 affects version 9.7.2 of mongoose." }, { "status": "affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-02T20:07:00.091345+00:00", "status_notes": "Vulnerability CVE-2026-42334 affects version 9.7.2 of mongoose.", "vulnerability": { "name": "CVE-2026-42334" }, "action_statement": "Vulnerability CVE-2026-42334 affects version 9.7.2 of mongoose." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2026-73562 does not affect version 9.7.2 of mongoose. not_affected \u2014 The target mongoose 9.7.2 repository is not affected by CVE-2026-73562 (prototype pollution in update casting). The upstream vendor (Automattic/Mongoose) included comprehensive fixes in the 9.7.2 release that TuxCare onboarded. All three main security commits (f494b8430 for query update handling, 35a3f33bc for schema defensive checks, 8fa236568 for document defensive checks) are present in HEAD...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-73562" }, "impact_statement": "not_affected \u2014 The target mongoose 9.7.2 repository is not affected by CVE-2026-73562 (prototype pollution in update casting). The upstream vendor (Automattic/Mongoose) included comprehensive fixes in the 9.7.2 release that TuxCare onboarded. All three main security commits (f494b8430 for query update handling, 35a3f33bc for schema defensive checks, 8fa236568 for document defensive checks) are present in HEAD..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/mongoose@9.7.2", "identifiers": { "purl": "pkg:npm/mongoose@9.7.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability GHSA-r5xw-q988-826m does not affect version 9.7.2 of mongoose. not_affected \u2014 Target mongoose 9.7.2 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability affected versions before 3.8.39/4.3.6, where assigning a numeric value to a Buffer field would allocate uninitialized heap memory. The upstream fix (commit 8066b145c, Jan 2016, by Valeri Karpov) wraps numeric input in arrays before Buffer creation, preventing siz...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-r5xw-q988-826m" }, "impact_statement": "not_affected \u2014 Target mongoose 9.7.2 is not affected by GHSA-r5xw-q988-826m (remote memory exposure via number-to-Buffer casting). The vulnerability affected versions before 3.8.39/4.3.6, where assigning a numeric value to a Buffer field would allocate uninitialized heap memory. The upstream fix (commit 8066b145c, Jan 2016, by Valeri Karpov) wraps numeric input in arrays before Buffer creation, preventing siz..." } ] }