fix(deps): update dependency mongoose to v5.13.23 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mongoose (source)	5.13.13 → 5.13.23

GitHub Vulnerability Alerts

CVE-2022-2564

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

CVE-2022-24304

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {}
console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

CVE-2025-23061

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

---

Release Notes

Automattic/mongoose (mongoose)

v5.13.23

Compare Source

v5.13.22

Compare Source

v5.13.21

Compare Source

v5.13.20

Compare Source

v5.13.19

Compare Source

v5.13.18

Compare Source

v5.13.17

Compare Source

====================

• fix: backport fix for array filters handling $or and $and #​13195 #​13192 #​10696 raj-goguardian
• fix: update the isIndexEqual function to take into account non-text indexes when checking compound indexes that include both text and non-text indexes #​13138 #​13136 rdeavila94

v5.13.16

Compare Source

====================

• fix: make access to process.versions lazy #​12584 maciasello
• fix(types): add missing type definitions for bulkSave() #​12019
• docs: backport documentation URL updates #​12692 hasezoey

v5.13.15

Compare Source

====================

• fix: backport fix for CVE-2022-2564 #​12281 shubanker
• docs: fix broken link from findandmodify method deprecation #​11366 laissonsilveira

v5.13.14

Compare Source

====================

• fix(timestamps): avoid setting createdAt on documents that already exist but dont have createdAt #​11024
• docs(models): fix up nModified example for 5.x #​11055

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.