CVE-2026-73259

Mongoose, a MongoDB object modeling tool, prior to versions 6.13.9, 7.8.9, 8.22.1, and 9.1.6 had a vulnerability that allowed bypassing the sanitizeFilter query sanitization mechanism via the $nor operator. This operator was not properly sanitized, allowing for the injection of malicious operators.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function tests hm.proto.len with an impossible greater-than-eight condition, so is_http_1_0 is never set, and Mongoose processes chunked encoding that an HTTP/1.0 proxy can ignore.

A vulnerability in Mongoose before version 7.22 allows an on-path network attacker with a wildcard certificate for a parent domain to impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern like *.example.com can match foo.bar.example.com.

A vulnerability in Mongoose before version 7.23 allows a network attacker to impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. The mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without verifying the certificate signature.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

Mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2 has a prototype pollution vulnerability when passing a user-controlled update with a __proto__.x dotted path under $set. The casting process can set properties on Object.prototype, affecting application integrity and availability.