# CVE-2026-125116: Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Automattic / mongoose: < 6.13.12 (affected); >= 7.0.0, < 7.8.13 (affected); >= 8.0.0, < 8.24.7 (affected); >= 9.0.0, < 9.11.4 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L; source: CNA: GitHub_M

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-843

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/releases/tag/6.13.12 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/releases/tag/7.8.13 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/releases/tag/8.24.7 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/releases/tag/9.11.4 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c (security-advisories@github.com)

- https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b (security-advisories@github.com)

- https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf (security-advisories@github.com)

- https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/releases/tag/6.13.12 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/releases/tag/7.8.13 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/releases/tag/8.24.7 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/releases/tag/9.11.4 (security-advisories@github.com)

- https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96 (security-advisories@github.com)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-125116; retrieved 2026-11-09; source updated 2026-11-09

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-125116; retrieved 2026-11-10; source updated 2026-11-09

Revision: f4ec013e26688bc38069288b4184ba7bf118f25ae3206d96d79b4305d1b4be66

Canonical: https://y2.dev/cve/CVE-2026-125116

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.