Registry / security / express-mongo-sanitize

express-mongo-sanitize

library2.2.0jsnpmunverified

Express 4.x middleware to sanitize user-supplied data (req.body, req.query, req.params, req.headers) by stripping or replacing MongoDB operator injection characters ($ and .). This package is widely used to prevent NoSQL injection attacks, particularly the $where operator. Version 2.2.0 is stable, typed (TypeScript declarations included), and supports both CommonJS and ESM via Node >=10. Key differentiators: simple drop-in middleware, configurable replaceWith character, allowDots option for nested queries, onSanitize callback, and dry run mode. Alternatives like mongo-sanitize are lower-level; express-mongo-sanitize integrates directly with Express.

security devops

npm install express-mongo-sanitize

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · EXPRESS-MONGO-SANI

express-mongo-sanitize

securityjavascriptv2.2.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

mongoSanitize

✓ import mongoSanitize from 'express-mongo-sanitize'

✗ const mongoSanitize = require('express-mongo-sanitize').default

ESM default import; CommonJS require works as const mongoSanitize = require('express-mongo-sanitize')

sanitize

✓ import { sanitize } from 'express-mongo-sanitize'

✗ const sanitize = require('express-mongo-sanitize').sanitize

Named export for direct use; CommonJS: const { sanitize } = require('express-mongo-sanitize')

SanitizeOptions

✓ import type { SanitizeOptions } from 'express-mongo-sanitize'

✗ const SanitizeOptions = require('express-mongo-sanitize').SanitizeOptions

TypeScript type only, not a runtime value; do not import as value

Express application that uses express-mongo-sanitize middleware to strip MongoDB operator injection characters from all request data.

import express from 'express'; import mongoSanitize from 'express-mongo-sanitize'; const app = express(); app.use(express.json()); app.use(mongoSanitize()); app.post('/data', (req, res) => { // req.body is now sanitized: keys like $ne, $where, or dots in keys are removed res.json({ received: req.body }); }); const PORT = process.env.PORT ?? 3000; app.listen(PORT, () => console.log(`Server running on port ${PORT}`));

Debug

Known issues

breakingVersion 2.x changed default behavior to sanitize req.headers in addition to req.body, req.params, req.query

fix

If you relied on headers being unsanitized, set onSanitize or use replaceWith to control which fields are sanitized

affects: >=2.0.0

deprecatedallowDots with replaceWith may cause issues on older MongoDB versions (<3.6) due to dots in keys

fix

Avoid allowDots unless targeting MongoDB >=3.6 or using replaceWith carefully

affects: *

gotchaSanitization does not apply to nested objects in arrays by default in some edge cases

fix

Ensure you test deeply nested payloads; the sanitize function recursively traverses objects

affects: >=1.0.0

gotchaWhen using CommonJS require, the default export is the middleware function, not an object with .sanitize()

fix

Use const mongoSanitize = require('express-mongo-sanitize') to get the middleware; for .sanitize, use const { sanitize } = require('express-mongo-sanitize')

affects: >=2.0.0

deprecateddryRun mode logs warnings but does not sanitize; ensure you enable actual sanitization in production

fix

Remove dryRun: true in production or implement the onSanitize callback to log and still sanitize

affects: >=2.1.0

Errors

Common errors & fixes

Cannot find module 'express-mongo-sanitize'

Missing npm install or incorrect import path

fix

Run 'npm install express-mongo-sanitize' and ensure your package.json includes it

TypeError: mongoSanitize is not a function

Using ESM import incorrectly with CommonJS require

fix

Use 'const mongoSanitize = require('express-mongo-sanitize')' or update to ESM import

Property 'sanitize' does not exist on type 'typeof import(...)'

Trying to import sanitize as a default export in TypeScript

fix

Use 'import { sanitize } from 'express-mongo-sanitize'' instead of default import

SanitizeOptions is not a constructor

Importing SanitizeOptions as a value instead of type

fix

Use 'import type { SanitizeOptions }' for type-only import

Upgrade

Version history

2.2.0latest on npm

Audit

Dependencies

expressrequiredPeer dependency for Express middleware integration

Agent activity

16 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/fiznool/express-mongo-sanitize ↗

packageexpress-mongo-sanitize ↗

homepagehttps://github.com/fiznool/express-mongo-sanitize#readme ↗