VYPR
← All advisories
High severityNVD Advisory· Published Jul 28, 2022· Updated Nov 20, 2024

Prototype Pollution in automattic/mongoose

CVE-2022-2564

Description

Prototype Pollution in Mongoose versions prior to 6.4.6 allows an attacker to pollute object prototypes via crafted input, potentially leading to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Prototype Pollution in Mongoose versions prior to 6.4.6 allows an attacker to pollute object prototypes via crafted input, potentially leading to remote code execution.

Vulnerability

Details

CVE-2022-2564 is a Prototype Pollution vulnerability affecting Mongoose, a MongoDB object modeling tool for Node.js and Deno, in versions prior to 6.4.6 [1][2]. The flaw resides in how Mongoose handles object merging or schema processing, allowing an attacker to inject properties into an object's prototype chain.

Attack

Vector and Prerequisites

Exploitation requires the attacker to provide crafted input that is processed by Mongoose's internal functions. The specific vulnerable code resides in lib/schema.js [3]. An attacker does not need authenticated access to the application, but must be able to supply data that Mongoose processes (e.g., through user-controlled JSON bodies, query parameters, or file uploads). No special network position is required beyond HTTP accessibility.

Impact

Successful exploitation of Prototype Pollution can lead to severe consequences, including arbitrary code execution, denial of service, or property injection that bypasses security controls. By polluting Object.prototype, the attacker can alter the behavior of all objects in the application, potentially enabling remote code execution [3].

Mitigation

The vulnerability was patched in Mongoose version 6.4.6 [2][4]. Users are strongly advised to upgrade to this version or later. No workarounds are documented, and the fix addresses the root cause by sanitizing object operations that could lead to prototype pollution.

References
  1. GitHub - Automattic/mongoose: MongoDB object modeling designed to work in an asynchronous environment.
  2. Comparing 6.4.5...6.4.6 · Automattic/mongoose
  3. NVD - CVE-2022-2564
  4. mongoose/CHANGELOG.md at master · Automattic/mongoose

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mongoosenpm
>= 6.0.0, < 6.4.66.4.6
mongoosenpm
< 5.13.155.13.15

Affected products

3

Patches

2
99b418941e2f

Merge pull request #12297 from shubanker/issue/prototype-pollution-5.x-patch

https://github.com/Automattic/mongooseValeri KarpovAug 21, 2022via ghsa
commit
2 files changed · +17 −0
  • lib/schema.js+7 −0 modified
    @@ -478,6 +478,10 @@ Schema.prototype.add = function add(obj, prefix) {
   const keys = Object.keys(obj);
 
   for (const key of keys) {
+    if (utils.specialProperties.has(key)) {
+      continue;
+    }
+
     const fullPath = prefix + key;
 
     if (obj[key] == null) {
@@ -663,6 +667,9 @@ Schema.prototype.path = function(path, obj) {
   let fullPath = '';
 
   for (const sub of subpaths) {
+    if (utils.specialProperties.has(sub)) {
+      throw new Error('Cannot set special property `' + sub + '` on a schema');
+    }
     fullPath = fullPath += (fullPath.length > 0 ? '.' : '') + sub;
     if (!branch[sub]) {
       this.nested[fullPath] = true;
  • test/schema.test.js+10 −0 modified
    @@ -2682,4 +2682,14 @@ describe('schema', function() {
     assert.equal(TestSchema.path('testprop.$*').instance, 'Number');
     assert.equal(TestSchema.path('testprop.$*').options.ref, 'OtherModel');
   });
+
+  it('disallows setting special properties with `add()` or constructor (gh-12085)', function() {
+    const maliciousPayload = '{"__proto__.toString": "Number"}';
+
+    assert.throws(() => {
+      mongoose.Schema(JSON.parse(maliciousPayload));
+    }, /__proto__/);
+
+    assert.ok({}.toString());
+  });
 });
a45cfb6b0ce0

fix(schema): disallow setting __proto__ when creating schema with dotted properties

https://github.com/Automattic/mongooseValeri KarpovJul 19, 2022via ghsa
commit
2 files changed · +17 −0
  • lib/schema.js+7 −0 modified
    @@ -554,6 +554,10 @@ Schema.prototype.add = function add(obj, prefix) {
   const keys = Object.keys(obj);
   const typeKey = this.options.typeKey;
   for (const key of keys) {
+    if (utils.specialProperties.has(key)) {
+      continue;
+    }
+
     const fullPath = prefix + key;
     const val = obj[key];
 
@@ -854,6 +858,9 @@ Schema.prototype.path = function(path, obj) {
   let fullPath = '';
 
   for (const sub of subpaths) {
+    if (utils.specialProperties.has(sub)) {
+      throw new Error('Cannot set special property `' + sub + '` on a schema');
+    }
     fullPath = fullPath += (fullPath.length > 0 ? '.' : '') + sub;
     if (!branch[sub]) {
       this.nested[fullPath] = true;
  • test/schema.test.js+10 −0 modified
    @@ -2792,4 +2792,14 @@ describe('schema', function() {
       });
     }, /Cannot use schema-level projections.*subdocument_mapping.not_selected/);
   });
+
+  it('disallows setting special properties with `add()` or constructor (gh-12085)', async function() {
+    const maliciousPayload = '{"__proto__.toString": "Number"}';
+
+    assert.throws(() => {
+      mongoose.Schema(JSON.parse(maliciousPayload));
+    }, /__proto__/);
+
+    assert.ok({}.toString());
+  });
 });

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.