Mongoose
69 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Mongoose, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Mongoose CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 10 |
| 2024-12 | 1 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 3 |
| 2026-03 | 0 |
| 2026-04 | 5 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 9 |
| 2026-09 | 0 |
Severity
How the 69 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical25
- High15
- Medium21
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Mongoose.
- CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching—
- CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file read6.5
- CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing render5.4
- CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE9.1
- CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing5.4
- CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart6.5
- CVE-2026-73251Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification—
- CVE-2026-73257Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling9.1
- CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)6.5
- GHSA-664h-wqgq-64gwMongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)—
- CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing7.5
- CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection7.5
- CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification3.7
- CVE-2026-6985Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop5.3
- CVE-2026-5246Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization5.6
Product grouping is registry-driven, with AI assist and human review. How it works