Automattic/mongoose · error · MongooseError

Cannot use $where filter with populate() match

Error message

Cannot use $where filter with populate() match

What it means

Error "Cannot use $where filter with populate() match" thrown in Automattic/mongoose.

Source

Thrown at lib/helpers/populate/getModelsMapForPopulate.js:890

/**
 * Throw an error if there are any $where keys to defend against [CVE-2024-53900](https://nvd.nist.gov/vuln/detail/CVE-2024-53900)
 *
 * Note that this is ONLY for $where because sift executes $where in Node.js memory.
 * Other forms of MongoDB server-side execution, like $expr, are NOT filtered out.
 * This function is not meant to protect against server-side execution in MongoDB.
 */

function throwOn$where(match) {
  if (match == null) {
    return;
  }
  if (typeof match !== 'object') {
    return;
  }
  for (const key of Object.keys(match)) {
    if (key === '$where') {
      throw new MongooseError('Cannot use $where filter with populate() match');
    }
    if (match[key] != null && typeof match[key] === 'object') {
      throwOn$where(match[key]);
    }
  }
}

View on GitHub (pinned to 49cdab0136)

When it happens

Trigger: Thrown at lib/helpers/populate/getModelsMapForPopulate.js:890 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Automattic/mongoose@49cdab0136 (2026-08-21). Data as JSON: /api/errors/9ca981b9d6a6531b. Report an issue: GitHub.