CVE-2023-3696

9.8 criticalEPSS 1.2%

Critical (9.8) in mongoosejs mongoose. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in mongoose 5.13.20, 6.11.3, 7.3.3.

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2023-07-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9m93-w8w6-76hh	npm	mongoose	>=7.0.0 <7.3.3	7.3.3
GHSA-9m93-w8w6-76hh	npm	mongoose	>=6.0.0 <6.11.3	6.11.3
GHSA-9m93-w8w6-76hh	npm	mongoose	<5.13.20	5.13.20