What is NoSQL injection?
NoSQL injection is the version of SQL injection for databases like MongoDB. Instead of text, an attacker sends a small query object, such as {"$ne": null}, that changes what your database query means, often letting them log in without the real password.
Also called: MongoDB injection
ON THIS PAGE
What it means
NoSQL databases take queries written as objects. If your app passes the request body straight into a query, an attacker can swap a simple value for an operator like "not equal to nothing", which matches every record.
The attack needs no hacking tools. It's just a different shape of data in a form or API call, which is why checking the type of each input matters.
Why it matters for vibe-coded apps
AI-built Node apps often pass req.body directly into a MongoDB call, because it's the shortest way to write a login or search.
- Someone can log in as any user without knowing the password.
- Searches can be bent to return data they shouldn't see.
- Your database may be read or changed in unexpected ways.
Example
A login route with MongoDB.
// attacker sends {"email":"admin@site.com","password":{"$ne":null}}
const user = await User.findOne({
email: req.body.email,
password: req.body.password,
});const { email, password } = z
.object({ email: z.string().email(), password: z.string() })
.parse(req.body); // an object here is rejected
const user = await User.findOne({ email });
const ok = user && (await bcrypt.compare(password, user.hash));Never put request values straight into a query without checking they are plain strings or numbers.
How to check if your app has this problem
- 1Search your code for find, findOne or update calls that use req.body or req.query directly.
- 2Send a login with a password of {"$ne": null} (as JSON) and see whether it gets in.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Validate every input to be a string or number before the query.
- 2Compare hashed passwords in code instead of querying by password.
- 3Turn on your database's query sanitising options where available.
- 4Run a check again to confirm.
Find every MongoDB query that uses request data directly. Validate each input with Zod so only plain strings and numbers are accepted, remove any password-in-query logins, and compare hashed passwords with bcrypt in code instead.
Check if your app has this problem
Paste your website and we'll check for noSQL injection issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- SQL injectionAn attacker types database commands into your app and it runs them.
- Input validationChecking that what users send your app is the right shape before you use it.
- Password hashingStoring passwords scrambled, so even you can't read them.
- Cross-site scripting (XSS)Someone sneaks code into your pages that runs in other users' browsers.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.