CVE-2026-125116

### Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (`__t` by default) in a plain object of registered discriminators, for example `Model.discriminators[doc.__t]`. That value comes from user documents and query filters. Because the lookup did not check own properties, a value that names a property inherited from `Object.prototype` resolves to that inherited value instead of a discriminator. Examples are `'constructor'`, `'toString'` and `'hasOwnProperty'`. - `__t: 'constructor'` resolves to the global `Object` function. Mongoose then calls `new Object(doc)`, which returns the raw user object where a Mongoose document is expected. - `__t: 'toString'` and similar names resolve to built-in functions that throw when used as a constructor or schema. The most serious effect: through `bulkWrite()` `insertOne` with `skipValidation: true`, the raw user object is stored as-is, without schema casting or `strict` filtering. After that, every query that returns the stored document throws, until the document is removed from the database. ### Details The registries that hold discriminators are plain objects: `Model.discriminators`, `schema.discriminators`, and the embedded discriminator registries on document arrays and single nested subdocuments. Several code paths indexed them directly with a value taken from the document or filter: | Code path | Input | |---|---| | Model constructor (`new Model(doc)`) | document | | `Model.create()`, `insertMany()`, `bulkWrite()`, `bulkSave()` | documents | | Hydrating query results (`find()`, `findOne()`, etc.) and `Model.hydrate()` | stored documents | | Casting query filters, including flat paths such as `'events.__t'` and `$elemMatch` | query filter | | Casting updates and array filters | update filter, `arrayFilters` | | Document array `push()` / `create()`, document array and single nested casting | subdocuments | | Populate on embedded discriminators | stored subdocument