From 531fecc82b052deefabe429b5c4e38029231efaa Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Mon, 27 Jul 2026 12:40:14 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=8D=83=20chore:=20Bump=20Mongoose=20to=20?=
 =?UTF-8?q?8.24.1=20to=20Patch=20Prototype=20Pollution=20(#14461)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes GHSA-664h-wqgq-64gw (CVSS 6.5, CWE-1321), a prototype pollution
in update casting via a __proto__-prefixed dotted path. Affected range
is >=8.0.0 <8.24.1, so 8.23.1 was flagged by npm audit.
---
 api/package.json                   |  2 +-
 package-lock.json                  | 12 ++++++------
 packages/api/package.json          |  2 +-
 packages/data-schemas/package.json |  2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/api/package.json b/api/package.json
index 55e68ad46c..bf62ef945e 100644
--- a/api/package.json
+++ b/api/package.json
@@ -102,7 +102,7 @@
     "mime": "^3.0.0",
     "module-alias": "^2.2.3",
     "mongodb": "^6.14.2",
-    "mongoose": "^8.23.1",
+    "mongoose": "^8.24.1",
     "multer": "^2.2.0",
     "nanoid": "^3.3.7",
     "node-fetch": "^2.7.0",
diff --git a/package-lock.json b/package-lock.json
index 5c05796f61..b21ddcece1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -117,7 +117,7 @@
         "mime": "^3.0.0",
         "module-alias": "^2.2.3",
         "mongodb": "^6.14.2",
-        "mongoose": "^8.23.1",
+        "mongoose": "^8.24.1",
         "multer": "^2.2.0",
         "nanoid": "^3.3.7",
         "node-fetch": "^2.7.0",
@@ -33704,9 +33704,9 @@
       }
     },
     "node_modules/mongoose": {
-      "version": "8.23.1",
-      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.23.1.tgz",
-      "integrity": "sha512-gHSPD8qEwRmiXapK17hEnFWZdcFENMegHTcw5XIIg2+7R8eXQvdwSiMpD/A2oG8tKzFLLHyRXd8/eaDPAVwZgQ==",
+      "version": "8.24.1",
+      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-8.24.1.tgz",
+      "integrity": "sha512-UpHBA0l5kHyKJQFjmBaFYQFo5sgz1DK0TRqDkOyBLYbqiIbKKhIvBpHWBXqeo0rgW4kGI1UhhAw+kTQZoj1BdA==",
       "license": "MIT",
       "dependencies": {
         "bson": "^6.10.4",
@@ -43738,7 +43738,7 @@
         "mathjs": "^15.2.0",
         "memorystore": "^1.6.7",
         "mongodb": "^6.14.2",
-        "mongoose": "^8.23.1",
+        "mongoose": "^8.24.1",
         "nanoid": "^3.3.7",
         "node-fetch": "2.7.0",
         "pdfjs-dist": "^5.4.624",
@@ -46124,7 +46124,7 @@
         "librechat-data-provider": "*",
         "lodash": "^4.17.23",
         "meilisearch": "^0.38.0",
-        "mongoose": "^8.23.1",
+        "mongoose": "^8.24.1",
         "nanoid": "^3.3.7",
         "winston": "^3.17.0",
         "winston-daily-rotate-file": "^5.0.0"
diff --git a/packages/api/package.json b/packages/api/package.json
index 19e8da0db9..7697175069 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -155,7 +155,7 @@
     "mathjs": "^15.2.0",
     "memorystore": "^1.6.7",
     "mongodb": "^6.14.2",
-    "mongoose": "^8.23.1",
+    "mongoose": "^8.24.1",
     "nanoid": "^3.3.7",
     "node-fetch": "2.7.0",
     "pdfjs-dist": "^5.4.624",
diff --git a/packages/data-schemas/package.json b/packages/data-schemas/package.json
index 254ac5558f..0c86c97db1 100644
--- a/packages/data-schemas/package.json
+++ b/packages/data-schemas/package.json
@@ -80,7 +80,7 @@
     "librechat-data-provider": "*",
     "lodash": "^4.17.23",
     "meilisearch": "^0.38.0",
-    "mongoose": "^8.23.1",
+    "mongoose": "^8.24.1",
     "nanoid": "^3.3.7",
     "winston": "^3.17.0",
     "winston-daily-rotate-file": "^5.0.0"