CVE-2026-125116: Type Confusion in Mongoose Discriminator Resolution

Vulnerability ID: CVE-2026-125116
CVSS Score: 4.8
Published: 2026-11-10

CVE-2026-125116 (GHSA-wr5m-5jph-8m96) is a type confusion vulnerability (CWE-843) in Mongoose, the MongoDB object modeling library for Node.js. When resolving discriminator models or schemas via user-supplied discriminator keys (defaulting to __t), Mongoose performs direct property indexing on plain JavaScript registry objects without verifying own-property ownership. Supplying inherited Object.prototype property names such as 'constructor' causes Mongoose to resolve built-in functions rather than valid Mongoose constructors, resulting in unhandled runtime exceptions, schema validation bypasses, and persistent collection query denial of service.

TL;DR

Mongoose prior to versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4 fails to check whether a discriminator key is an own property on discriminator registry objects. Attackers supplying __t: 'constructor' can bypass schema strictness and validation in specific write operations or trigger unhandled TypeErrors during document instantiation and query hydration.

⚠️ Exploit Status: POC

Technical Details

CVE / Advisory ID: CVE-2026-125116 / GHSA-wr5m-5jph-8m96
Weakness Class: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVSS v3.1 Score: 4.8 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
EPSS Score: 0.34% (27.55th Percentile)
Attack Vector: Network (Untrusted JSON input controlling Mongoose discriminator keys)
Impact: Schema Validation & Strictness Bypass, Request DoS, Persistent Query DoS
Exploit Status: Public Proof-of-Concept (PoC) Available
CISA KEV Status: Not Listed

Affected Systems

Mongoose (npm package mongoose)
mongoose: < 6.13.12 (Fixed in: 6.13.12)
mongoose: >= 7.0.0, < 7.8.13 (Fixed in: 7.8.13)
mongoose: >= 8.0.0, < 8.24.7 (Fixed in: 8.24.7)
mongoose: >= 9.0.0, < 9.11.4 (Fixed in: 9.11.4)

Code Analysis

Commit: 0ecd804

Use getDiscriminatorByKey helper to ignore inherited properties on discriminator lookups

Commit: 18afab7

Patch discriminator key lookup across model, query, and schema casting paths

Commit: 390453c

Backport discriminator key lookup fix

Commit: 8cee51b

Backport discriminator key lookup fix

Commit: b26c435

Backport discriminator key lookup fix

Commit: b68f907

Backport discriminator key lookup fix

Exploit Details

GitHub Security Advisory: Official GitHub Security Advisory containing proof-of-concept code demonstrating type confusion via __t: 'constructor' and persistent collection poisoning via bulkWrite.

Mitigation Strategies

Upgrade Mongoose to a patched version (6.13.12, 7.8.13, 8.24.7, or 9.11.4) where discriminator lookups enforce own-property checks.
Implement strict allowlist validation on incoming discriminator keys (such as __t) at the API boundary before passing payloads to Mongoose models or queries.
Disable skipValidation: true in Model.bulkWrite() operations when processing untrusted or user-supplied input.
Audit existing MongoDB collections using native database drivers to identify and purge documents containing Object.prototype property names in the __t field.

Remediation Steps:

Identify the currently installed version of mongoose using npm list mongoose.
Update package.json to reference at least version 6.13.12 (for v6.x), 7.8.13 (for v7.x), 8.24.7 (for v8.x), or 9.11.4 (for v9.x).
Run npm install or npm update mongoose and verify the lockfile reflects the patched version.
If collections were exposed to untrusted bulkWrite operations, run a native MongoDB query to check for documents where __t equals 'constructor' or other Object.prototype methods and remove them.