How to fix NoSQL Injection

What an attacker can do

The concrete impact of leaving NoSQL Injection unpatched.

How to fix NoSQL Injection

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Cast input fields to expected types before querying

   If the field should be a string, force it to a string. If it should be a number, parse it. Reject objects.

   Express middleware like `express-mongo-sanitize` strips keys starting with `$` or containing `.`. ODMs like Mongoose enforce schema types when you use schema-validated methods.

   javascriptStep 1

   // ❌ Vulnerable — accepts any input shape
   app.post("/login", async (req, res) => {
     const user = await User.findOne({
       username: req.body.username,
       password: hashed(req.body.password),
     });
     if (user) res.json({ ok: true });
   });
   
   // ✅ Force input to strings
   app.post("/login", async (req, res) => {
     const username = String(req.body.username ?? "");
     const password = String(req.body.password ?? "");
     if (!username || !password) return res.sendStatus(400);
     const user = await User.findOne({
       username,
       password: hashed(password),
     });
     if (user) res.json({ ok: true });
   });
   
   // ✅ Or use express-mongo-sanitize as middleware
   import mongoSanitize from "express-mongo-sanitize";
   app.use(mongoSanitize());

2. 2

   Use schema-validated ORMs/ODMs (Mongoose, Prisma)

   ODMs with schemas reject objects where strings are expected at the type level — eliminating most NoSQLi paths.

   Mongoose: define types in schema; `find({ username })` casts. Prisma's MongoDB connector type-checks at compile time. Skip raw `db.collection.find()` calls when possible.

   javascriptStep 2

   import mongoose from "mongoose";
   
   const UserSchema = new mongoose.Schema({
     username: { type: String, required: true, index: true },
     password: { type: String, required: true },
     role: { type: String, enum: ["admin", "member"], default: "member" },
   });
   
   const User = mongoose.model("User", UserSchema);
   
   // Mongoose casts username to String. Object input throws a CastError.
   const user = await User.findOne({ username: req.body.username });

3. 3

   Validate request bodies with a schema (Zod, Joi, AJV)

   Reject the request before it reaches the query layer. Schemas describe exactly what shape input should have; anything else is rejected.

   Zod is the modern TypeScript-friendly choice. Add it to every route — it documents the API as a side effect.

   typescriptStep 3

   import { z } from "zod";
   
   const LoginSchema = z.object({
     username: z.string().min(1).max(64),
     password: z.string().min(1).max(128),
   });
   
   app.post("/login", async (req, res) => {
     const parsed = LoginSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: "Bad request" });
   
     const { username, password } = parsed.data;
     const user = await User.findOne({ username, password: hashed(password) });
     res.json(user ? { ok: true } : { error: "Invalid credentials" });
   });

4. 4

   Disable $where and server-side JavaScript

   MongoDB's `$where` accepts JavaScript that runs on the server. Disable it at the database level.

   MongoDB 5.0+ disables it by default; older versions need `--noscripting` flag or `setParameter` config. If you must use `$where`, never include user input.

   yamlStep 4

   # mongod.conf — disable JS execution
   security:
     javascriptEnabled: false
   
   # Or at runtime (requires admin):
   # db.adminCommand({setParameter: 1, allowDiskUse: false})
   
   # In your code, NEVER do this:
   # db.users.find({ $where: `this.score > ${userInput}` })
   
   # If you need scoring/sorting, use aggregation pipeline:
   # db.users.aggregate([{ $match: { score: { $gt: parseInt(userInput, 10) }}}])

5. 5

   Limit regex inputs to prevent ReDoS

   If users can supply regex patterns (search features), use a regex engine with execution-time limits, or compile their pattern with anchors and length limits.

   Node's V8 regex is vulnerable to ReDoS. Use `re2-wasm` for safe regex (Google's RE2 doesn't backtrack). For simple search, use `$text` indexes or `$regex` with strict caps on input length and complexity.

   javascriptStep 5

   // ❌ User regex passed straight to MongoDB
   const results = await Posts.find({ title: { $regex: req.query.q } });
   
   // ✅ Escape user input as literal string in regex
   function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   }
   const safe = escapeRegex(String(req.query.q ?? "")).slice(0, 100);
   const results = await Posts.find({
     title: { $regex: safe, $options: "i" },
   });
   
   // ✅ Better: use a text index
   // Posts.createIndex({ title: "text" })
   // Posts.find({ $text: { $search: req.query.q }})