CVE-2026-73562

What it actually does

Prototype pollution via Mongoose update casting: Schema.prototype.path and _getPathType treat inherited properties from schema.paths/schema.nested as valid types when a __proto__.x dotted path is supplied under $set in a user-controlled update, allowing the casting process to attach $fullPath and $parentSchemaDocArray to Object.prototype before throwing.

Why it matters to the business

Applications may experience unexpected object property inheritance, leading to logic errors, data integrity violations, or availability issues; widespread use of Mongoose in Node.js stacks increases operational risk until patched.

How an attack unfolds

An attacker supplies a malicious payload containing a __proto__.x dotted path inside a user-controlled update object (e.g., req.body) to Mongoose update methods; during casting the library's schema path resolution pollutes Object.prototype, making attacker-controlled properties visible on subsequently created objects and affecting application behavior.

How to fix it

Upgrade Mongoose to version 6.13.10, 7.8.10, 8.24.1, or 9.7.2. Review all update operations that accept user input and ensure strict schema validation or sanitization before passing data to Mongoose.

How to confirm the fix worked

Confirm installed Mongoose version meets or exceeds the fixed releases; attempt reproduction with a minimal __proto__ dotted-path update payload in a test environment and verify that prototype pollution no longer occurs.

Typical attack path

1. Identify Mongoose update calls that accept untrusted input such as updateOne(filter, req.body)
2. Craft payload containing __proto__.x under $set or equivalent
3. Submit payload to trigger update casting
4. Observe or leverage resulting prototype pollution for integrity or availability impact

How to detect it

Review application and database logs for update operations containing __proto__ or prototype-related keys; inspect error traces that mention path casting or schema type resolution; search runtime for unexpected properties on Object.prototype after update calls.

What your security team should do

• Immediately upgrade all Mongoose instances to the fixed versions listed
• Audit code for direct passing of request bodies or user data into update operations
• Add input validation or schema enforcement around update payloads
• Monitor dependency updates and re-test affected services after patching