Sourced from The GitHub Security Advisory Database.

Remote Memory Exposure in mongoose Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Recommendation

Update to version 4.3.6, 3.8.39 or later.

Affected versions: >= 3.5.5 <= 3.8.38

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects mongoose Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Affected versions: < 5.7.5

Sourced from The Node Security Working Group.

Remote Memory Exposure Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Affected versions: >=3.5.5 =4.0.0 <=4.3.5

Sourced from mongoose's changelog.

5.13.5 / 2021-07-30

• perf(index.d.ts): improve typescript type checking performance #10515 andreialecu
• fix(index.d.ts): fix debug type in MongooseOptions #10510 thiagokisaki
• docs(api): clarify that depopulate() with no args depopulates all #10501 gfrancz

5.13.4 / 2021-07-28

• fix: avoid pulling non-schema paths from documents into nested paths #10449
• fix(update): support overwriting nested map paths #10485
• fix(update): apply timestamps to subdocs that would be newly created by $setOnInsert #10460
• fix(map): correctly clone subdocs when calling toObject() on a map #10486
• fix(cursor): cap parallel batchSize for populate at 5000 #10449
• fix(index.d.ts): improve autocomplete for new Model() by making doc an object with correct keys #10475
• fix(index.d.ts): add MongooseOptions interface #10471 thiagokisaki
• fix(index.d.ts): make LeanDocument work with PopulatedDoc #10494
• docs(mongoose+connection): correct default value for bufferTimeoutMS #10476
• chore: remove unnecessary 'eslint-disable' comments #10466 thiagokisaki

5.13.3 / 2021-07-16

• fix(model): avoid throwing error when bulkSave() called on a document with no changes #10437
• fix(timestamps): apply timestamps when creating new subdocs with $addToSet and with positional operator #10447
• fix(schema): allow calling Schema#loadClass() with class that has a static getter with no setter #10436
• fix(model): handle re-applying object defaults after explicitly unsetting #10442 semirturgay
• fix: bump mongodb driver -> 3.6.10 #10440 AbdelrahmanHafez
• fix(index.d.ts): consistently use NativeDate instead of Date for Date validators and timestamps functions #10426
• fix(index.d.ts): allow calling discriminator() with non-document #10452 #10421 DouglasGabr
• fix(index.d.ts): allow passing ResultType generic to Schema#path() #10435

5.13.2 / 2021-07-03

• fix: hardcode @​types/node version for now to avoid breaking changes from DefinitelyTyped/DefinitelyTyped#53669 #10415
• fix(index.d.ts): allow using type: Date with Date paths in SchemaDefinitionType #10409
• fix(index.d.ts): allow extra VirtualTypeOptions for better plugin support #10412
• docs(api): add SchemaArray to docs #10397
• docs(schema+validation): fix broken links #10396
• docs(transactions): add note about creating a connection to transactions docs #10406

5.13.1 / 2021-07-02

• fix(discriminator): allow using array as discriminator key in schema and as tied value #10303
• fix(index.d.ts): allow using & Document in schema definition for required subdocument arrays #10370
• fix(index.d.ts): if using DocType that doesn't extends Document, default to returning that DocType from toObject() and toJSON() #10345
• fix(index.d.ts): use raw DocType instead of LeanDocument when using lean() with queries if raw DocType doesn't extends Document #10345
• fix(index.d.ts): remove err: any in callbacks, use err: CallbackError instead #10340
• fix(index.d.ts): allow defining map of schemas in TypeScript #10389
• fix(index.d.ts): correct return type for Model.createCollection() #10359
• docs(promises+discriminators): correctly escape () in regexp to pull in examples correctly #10364
• docs(update): fix outdated URL about unindexed upsert #10406 grimmer0125

... (truncated)

• c36bd64 chore: release 5.13.5
• b33599c Merge pull request #10510 from thiagokisaki/gh-10504
• d88f981 Merge pull request #10515 from andreialecu/perf-types
• 9c41c19 perf: improve typescript type checking performance
• f1e0de1 Merge pull request #10501 from gfrancz/patch-1
• ae819cc fix(index.d.ts): fix debug type in MongooseOptions
• 28b1aa3 fix: get rid of hardcoding of @​types/node re: DefinitelyTyped/DefinitelyTyped...
• b82aa37 Update depopulate documentation for document.js
• 6b33a7b chore: release 5.13.4
• 060039d fix(index.d.ts): improve autocomplete for new Model() by making doc an ob...
• Additional commits viewable in compare view

This version was pushed to npm by vkarpov15, a new releaser for mongoose since your current version.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)