CVE-2022-2564: Mongoosejs Mongoose

Critical severity, CVSS 9.8. EPSS: 32.7% chance of exploitation in the next 30 days.

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

Affected products

• Mongoosejs Mongoose: before 5.13.15 (fixed in 5.13.15); from 6.0.0, before 6.4.6 (fixed in 6.4.6)

Published 2022-07-28. Last modified 2026-06-17.