10 min read
NoSQL Injection, Part 1: Operator Injection in MongoDB APIs
Login bypass, password-reset takeover, and blind password extraction with $ne, $gt, $in, and $regex against a real Express + MongoDB driver lab. Includes why Express 5 only closes half the hole and why Mongoose 9 is still injectable by default.
#NoSQL Injection#MongoDB#API Security