Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-f825-f98c-gj3g: Prototype pollution Schema.path in automattic/mongoose

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

ghsa
#vulnerability#dos#nodejs#git#mongo
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2022-2564

Prototype pollution Schema.path in automattic/mongoose

High severity GitHub Reviewed Published Jul 29, 2022 • Updated Aug 4, 2022

We are still processing this advisory. You may have affected repositories that are not yet on this list. Check back soon for more.

Package

npm mongoose (npm)

Affected versions

< 6.4.6

Description

Related news

CVE-2022-2564

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.