Mongoose
This hub aggregates every CVE we track for Mongoose, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
69
CVEs tracked
25
Critical
15
High
0
In CISA KEV
Severity distribution
CRITICAL25MEDIUM21HIGH15LOW4
Monthly trend
0
10
1
1
0
0
0
0
0
0
0
1
0
1
0
0
3
0
5
1
0
2
9
0
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Mongoose.
- CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
- CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file read6.5
- CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing render5.4
- CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE9.1
- CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing5.4
- CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart6.5
- CVE-2026-73251Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
- CVE-2026-73257Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling9.1
- CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)6.5
- GHSA-664h-wqgq-64gwMongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
- CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing7.5
- CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection7.5
- CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification3.7
- CVE-2026-6985Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop5.3
- CVE-2026-5246Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization5.6
Product normalization is registry-driven with AI assist and human review. How it works