What Is NoSQL Injection?
NoSQL databases are not immune to injection — the “NoSQL” name refers to the data model, not to safety from untrusted input. Document stores like MongoDB have query languages of their own, and when user input is placed into a query unsafely, an attacker can change the query’s meaning. It is the same disease as SQL injection, in a different dialect.
How does NoSQL injection work?#
Two main forms appear. Operator injection exploits query languages that accept structured objects. If a login handler passes the request body straight into a query:
Expected: { username: "alex", password: "hunter2" }
Attack: { username: "alex", password: { "$ne": null } }
Meaning: password not equal to null → matches, login bypassedThe attacker sent an object where the app expected a string, smuggling a query operator
($ne). The second form abuses databases that evaluate server-side JavaScript, letting
crafted input run as code — closer to command injection.
How do you prevent it?#
| Defense | Effect |
|---|---|
| Type validation / casting | Reject an object where a string is expected |
| Parameterized driver methods | Keep input as data, not query structure |
| Disable server-side JS eval | Removes the code-execution path |
| Least-privilege DB accounts | Limit blast radius |
The cornerstone is type checking: an enormous share of NoSQL injection is stopped simply by ensuring a field that should be a string is actually a string before it reaches the query.
NoSQL injection proves injection is about interpreters, not SQL specifically. More at the Web Security hub.
Frequently asked questions#
Can NoSQL databases suffer injection?
Yes. Although they do not use SQL, NoSQL databases like MongoDB have their own query languages that can be injected. Common forms include operator injection — smuggling query operators such as $ne or $gt through user input — and abuse of server-side JavaScript evaluation. "NoSQL" does not mean "no injection."
How do you prevent NoSQL injection?
Validate and cast input to expected types (a login field should be a string, not an object), use the database driver’s parameterized query methods, and disable server-side JavaScript evaluation where possible. The principle is identical to SQL: keep user input as data, never let it become query structure or code.