NoSQL queries use safe type-safe constructors

NoSQL injection (CWE-943) is SQL injection's less-discussed cousin: instead of terminating a string and injecting SQL keywords, attackers inject MongoDB operators like $where, $gt, or $regex by submitting JSON objects where scalars are expected. OWASP API Security Top 10 2023 API10 (Unsafe Consumption of APIs) and OWASP A03 2021 (Injection) both cover this pattern. The attack is enabled by JavaScript's ...spread operator or Object.assign applied to user input before a findOne or find call — a common pattern when developers forward query parameters directly to database operations. The impact ranges from authentication bypass ({ password: { $gt: '' } } matches any password) to full document exfiltration.

Never spread or merge user input into NoSQL query objects. Map only the specific fields you need by name, and validate types before they reach the database layer.

// Bad — spreads user input directly into MongoDB query
const user = await db.collection('users').findOne({ ...req.body })

// Bad — merges query params into filter without type checking
const results = await db.collection('posts').find({ ...req.query }).toArray()

// Good — explicit field extraction with type coercion
const { email, name } = req.body as Record<string, unknown>
if (typeof email !== 'string' || typeof name !== 'string') {
  return res.status(400).json({ error: 'Invalid input' })
}
const user = await db.collection('users').findOne({ email, name })

In Mongoose or Prisma, typed schemas enforce field shapes and reject unknown operator keys automatically.