Describe the Bug
CVE-2024-53900 affects mongoose lower than 8.8.3, which affects @payloadcms/db-mongodb
Currently PayloadCMS is using 8.8.1
Link to the code that reproduces this issue
https://avd.aquasec.com/nvd/2024/cve-2024-53900
Reproduction Steps
npx create-payload-app- Choose
MongoDB as database
- List all dependencies:
$ npm list --all
myproject@1.0.0 /Users/code/myproject
├─┬ @payloadcms/db-mongodb@3.3.0
│ ├── http-status@1.6.2
│ ├── mongoose-aggregate-paginate-v2@1.1.2
│ ├── mongoose-paginate-v2@1.8.5
│ ├─┬ mongoose@8.8.1
Which area(s) are affected? (Select all that apply)
db-mongodb
Environment Info
Running `npm run payload info`:
Binaries:
Node: 20.17.0
npm: 10.8.2
Yarn: 1.22.22
pnpm: N/A
Relevant Packages:
payload: 3.3.0
next: 15.0.3
@payloadcms/db-mongodb: 3.3.0
@payloadcms/email-nodemailer: 3.3.0
@payloadcms/graphql: 3.3.0
@payloadcms/next/utilities: 3.3.0
@payloadcms/payload-cloud: 3.3.0
@payloadcms/richtext-lexical: 3.3.0
@payloadcms/translations: 3.3.0
@payloadcms/ui/shared: 3.3.0
react: 19.0.0-rc-66855b96-20241106
react-dom: 19.0.0-rc-66855b96-20241106
Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 24.1.0: Thu Oct 10 21:00:32 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T6030
Available memory (MB): 36864
Available CPU cores: 11
Describe the Bug
CVE-2024-53900 affects mongoose lower than 8.8.3, which affects @payloadcms/db-mongodb
Currently PayloadCMS is using 8.8.1
Link to the code that reproduces this issue
https://avd.aquasec.com/nvd/2024/cve-2024-53900
Reproduction Steps
npx create-payload-appMongoDBas databaseWhich area(s) are affected? (Select all that apply)
db-mongodb
Environment Info