CVE-2025-23061: Critical Search Injection in Mongoose Before 8.9.5

CVE-2025-23061 is a critical (CVSS 9.0) search injection flaw in Mongoose, the Node.js MongoDB library. A nested $where filter inside a populate() match was not blocked before version 8.9.5. It exists because an earlier fix for CVE-2024-53900 was incomplete. Upgrade to 8.9.5 or later.

What's affected

The NVD record says Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match. The 8.9.5 release, dated 13 January 2025, lists the fix as "disallow nested $where in populate match".

The record adds that the issue exists because of an incomplete fix for CVE-2024-53900. Projects that patched that earlier CVE but stayed on a version before 8.9.5 are still affected. The vector marks high attack complexity and a changed scope, which explains the score of 9.0 rather than 9.8.

How to check if you're exposed

List the installed version, including copies pulled in by other packages:

npm ls mongoose
npm view mongoose version

For a lock file only check, run npm ls mongoose in each service. Monorepos often contain several copies. Also search your code for populate calls that pass a match built from request data, since those are the places where the flaw can matter.

Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.

What to do now

1. Upgrade Mongoose to 8.9.5 or later in every service.
2. Run npm ls mongoose again and confirm no older copy remains in transitive dependencies.
3. Never pass raw request objects into populate match or find filters. Build the filter from allowed fields with expected types.
4. Consider the sanitizeFilter option for queries built from user input.
5. Add a dependency scan to CI so the next Mongoose advisory surfaces automatically.

Why it matters

CWE-94 is code injection. The $where operator in MongoDB takes JavaScript to evaluate on the server, so letting user input reach it is dangerous. Mongoose had checks to block that operator in filters, but a nested form inside a populate match slipped through, and that is the path this CVE fixes.

The lesson is about incomplete fixes. The first patch handled one shape of the problem and a second shape remained. When an advisory names a prior CVE, check that your version includes later fixes, not only the first one. The KEV flag is false and no exploitation is claimed in the record.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Mongoose 8.9.5 release notes

Last reviewed: 19 October 2026.