References https://avd.aliyun.com/detail?id=AVD-2023-3696 https://github.com/advisories/GHSA-9m93-w8w6-76hh https://nvd.nist.gov/vuln/detail/CVE-2023-3696 https://security.snyk.io/vuln/SNYK-JS-MONGOOSE-5777721 https://huntr.com/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467 https://www.sentinelone.com/vulnerability-database/cve-2023-3696/ https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d https://security.zone.ci/aliyun/ali_highrisk/10841.html https://szczecin.github.io/2024/01/23/CVE-2023-3696-Mongoose/ https://cn-sec.com/archives/2124224.html
Related VulnerabilitiesPoCCVE-2024-53900: Mongoose < 8.8.3 - Remote Code ExecutionPoCCVE-2025-23061: Mongoose - NoSQL Injection