Mongoose, a MongoDB object modeling tool, suffers from a prototype pollution vulnerability (CWE-1321) in versions prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2. When user-controlled updates such as MyModel.updateOne(filter, req.body) include a __proto__.x dotted path under $set, the update casting process incorrectly treats inherited properties of schema.paths and schema.nested as schema types. This allows setting $fullPath and $parentSchemaDocArray on Object.prototype before an error is thrown. As a result, these properties become visible on newly created objects, potentially impacting application integrity and availability. The issue is addressed in the specified fixed versions.

The vulnerability allows an attacker to perform prototype pollution by injecting properties into Object.prototype via crafted update queries. This can lead to altered application behavior, compromising data integrity and potentially causing denial of service or other availability issues. Confidentiality impact is not indicated. No known exploits in the wild have been reported.

This vulnerability is fixed in mongoose versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. Users should upgrade to these or later versions to remediate the issue. Patch status is confirmed by the version fixes stated in the description. No additional vendor advisory content is provided, so check official mongoose release notes for further guidance.