CVE-2019-17426

⛔ critical

Summary

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

CVSS Score

9.1

Critical

EPSS Score

0.2

Exploit Probability

Published Date

2019-10-10

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 87.7% of all 338,292 vulnerabilities in our database.

#41,591

Top 25% most severe

Severity Percentile

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
mongoosejs	mongoose	Affected	≤ 5.7.4

🔗 References 2

https://github.com/Automattic/mongoose/commit/f3eca5...

Patch

https://github.com/Automattic/mongoose/issues/8222

Third Party Advisory

🔗 Related CVEs 5

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42334	⚠️ high	7.5	0.0	Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22...	2026-05-14
CVE-2025-23061	⛔ critical	9.0	64.8	Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NO...	2025-01-15
CVE-2024-53900	⛔ critical	9.1	45.9	Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.	2024-12-02
CVE-2023-3696	⛔ critical	9.8	0.3	Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.	2023-07-17
CVE-2022-2564	⛔ critical	9.8	2.9	Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.	2022-07-28

These CVEs affect the same products