Mongoose versions prior to 6.13.12, 7.0.0 to before 7.8.13, 8.0.0 to before 8.24.7, and 9.0.0 to before 9.11.4 contain a prototype pollution vulnerability via the Schema.prototype.virtual() method. This vulnerability allows attacker-controlled schema field names to modify Object.prototype and Function.prototype, potentially affecting all objects and functions in the environment. The issue persists because the 2022 fix for similar vulnerabilities did not cover the virtual() method. A patch is available in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.