{"id":42725,"library":"express-mongo-sanitize","title":"express-mongo-sanitize","description":"Express 4.x middleware to sanitize user-supplied data (req.body, req.query, req.params, req.headers) by stripping or replacing MongoDB operator injection characters ($ and .). This package is widely used to prevent NoSQL injection attacks, particularly the $where operator. Version 2.2.0 is stable, typed (TypeScript declarations included), and supports both CommonJS and ESM via Node >=10. Key differentiators: simple drop-in middleware, configurable replaceWith character, allowDots option for nested queries, onSanitize callback, and dry run mode. Alternatives like mongo-sanitize are lower-level; express-mongo-sanitize integrates directly with Express.","status":"active","version":"2.2.0","language":"javascript","source_language":"en","source_url":"https://github.com/fiznool/express-mongo-sanitize","tags":["javascript","mongodb","express","middleware","operator","injection","security","typescript"],"install":[{"cmd":"npm install express-mongo-sanitize","lang":"bash","label":"npm"},{"cmd":"yarn add express-mongo-sanitize","lang":"bash","label":"yarn"},{"cmd":"pnpm add express-mongo-sanitize","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Peer dependency for Express middleware integration","package":"express","optional":false}],"imports":[{"note":"ESM default import; CommonJS require works as const mongoSanitize = require('express-mongo-sanitize')","wrong":"const mongoSanitize = require('express-mongo-sanitize').default","symbol":"mongoSanitize","correct":"import mongoSanitize from 'express-mongo-sanitize'"},{"note":"Named export for direct use; CommonJS: const { sanitize } = require('express-mongo-sanitize')","wrong":"const sanitize = require('express-mongo-sanitize').sanitize","symbol":"sanitize","correct":"import { sanitize } from 'express-mongo-sanitize'"},{"note":"TypeScript type only, not a runtime value; do not import as value","wrong":"const SanitizeOptions = require('express-mongo-sanitize').SanitizeOptions","symbol":"SanitizeOptions","correct":"import type { SanitizeOptions } from 'express-mongo-sanitize'"}],"quickstart":{"code":"import express from 'express';\nimport mongoSanitize from 'express-mongo-sanitize';\n\nconst app = express();\napp.use(express.json());\napp.use(mongoSanitize());\n\napp.post('/data', (req, res) => {\n  // req.body is now sanitized: keys like $ne, $where, or dots in keys are removed\n  res.json({ received: req.body });\n});\n\nconst PORT = process.env.PORT ?? 3000;\napp.listen(PORT, () => console.log(`Server running on port ${PORT}`));","lang":"typescript","description":"Express application that uses express-mongo-sanitize middleware to strip MongoDB operator injection characters from all request data."},"warnings":[{"fix":"If you relied on headers being unsanitized, set onSanitize or use replaceWith to control which fields are sanitized","message":"Version 2.x changed default behavior to sanitize req.headers in addition to req.body, req.params, req.query","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"Avoid allowDots unless targeting MongoDB >=3.6 or using replaceWith carefully","message":"allowDots with replaceWith may cause issues on older MongoDB versions (<3.6) due to dots in keys","severity":"deprecated","affected_versions":"*"},{"fix":"Ensure you test deeply nested payloads; the sanitize function recursively traverses objects","message":"Sanitization does not apply to nested objects in arrays by default in some edge cases","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Use const mongoSanitize = require('express-mongo-sanitize') to get the middleware; for .sanitize, use const { sanitize } = require('express-mongo-sanitize')","message":"When using CommonJS require, the default export is the middleware function, not an object with .sanitize()","severity":"gotcha","affected_versions":">=2.0.0"},{"fix":"Remove dryRun: true in production or implement the onSanitize callback to log and still sanitize","message":"dryRun mode logs warnings but does not sanitize; ensure you enable actual sanitization in production","severity":"deprecated","affected_versions":">=2.1.0"}],"env_vars":null,"search_vec":"'10':58 '2.2.0':43 '4':6 'allowdot':69 'altern':80 'attack':37 'callback':75 'charact':26,68 'commonj':53 'configur':66 'data':14 'declar':48 'differenti':60 'direct':94 'dri':77 'drop':63 'drop-in':62 'esm':55 'express':2,5,90,96,99 'express-mongo-sanit':1,89 'includ':49 'inject':25,36,102 'integr':93 'javascript':97 'key':59 'level':88 'like':81 'lower':87 'lower-level':86 'middlewar':8,65,100 'mode':79 'mongo':3,83,91 'mongo-sanit':82 'mongodb':23,98 'nest':72 'node':57 'nosql':35 'onsanit':74 'oper':24,41,101 'option':70 'packag':29 'particular':38 'prevent':34 'queri':73 'replac':22 'replacewith':67 'req.body':15 'req.headers':18 'req.params':17 'req.query':16 'run':78 'sanit':4,10,84,92 'secur':103 'simpl':61 'stabl':45 'strip':20 'suppli':13 'support':51 'type':46 'typescript':47,104 'use':32 'user':12 'user-suppli':11 'version':42 'via':56 'wide':31 'x':7","created_at":"2026-06-05T16:56:21.763627+00:00","updated_at":"2026-06-05T16:56:21.763627+00:00","problems":[{"fix":"Run 'npm install express-mongo-sanitize' and ensure your package.json includes it","cause":"Missing npm install or incorrect import path","error":"Cannot find module 'express-mongo-sanitize'"},{"fix":"Use 'const mongoSanitize = require('express-mongo-sanitize')' or update to ESM import","cause":"Using ESM import incorrectly with CommonJS require","error":"TypeError: mongoSanitize is not a function"},{"fix":"Use 'import { sanitize } from 'express-mongo-sanitize'' instead of default import","cause":"Trying to import sanitize as a default export in TypeScript","error":"Property 'sanitize' does not exist on type 'typeof import(...)'"},{"fix":"Use 'import type { SanitizeOptions }' for type-only import","cause":"Importing SanitizeOptions as a value instead of type","error":"SanitizeOptions is not a constructor"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/fiznool/express-mongo-sanitize#readme","github":"https://github.com/fiznool/express-mongo-sanitize","docs":null,"changelog":null,"pypi":null,"npm":"express-mongo-sanitize","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security","devops"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-05","next_check":"2026-09-03","install_tag":null}}