{"record":{"id":"9ca981b9d6a6531b","repo":"Automattic/mongoose","slug":"cannot-use-where-filter-with-populate-match","errorCode":null,"errorMessage":"Cannot use $where filter with populate() match","messagePattern":"Cannot use \\$where filter with populate\\(\\) match","errorType":"exception","errorClass":"MongooseError","httpStatus":null,"severity":"error","filePath":"lib/helpers/populate/getModelsMapForPopulate.js","lineNumber":890,"sourceCode":"\n/**\n * Throw an error if there are any $where keys to defend against [CVE-2024-53900](https://nvd.nist.gov/vuln/detail/CVE-2024-53900)\n *\n * Note that this is ONLY for $where because sift executes $where in Node.js memory.\n * Other forms of MongoDB server-side execution, like $expr, are NOT filtered out.\n * This function is not meant to protect against server-side execution in MongoDB.\n */\n\nfunction throwOn$where(match) {\n  if (match == null) {\n    return;\n  }\n  if (typeof match !== 'object') {\n    return;\n  }\n  for (const key of Object.keys(match)) {\n    if (key === '$where') {\n      throw new MongooseError('Cannot use $where filter with populate() match');\n    }\n    if (match[key] != null && typeof match[key] === 'object') {\n      throwOn$where(match[key]);\n    }\n  }\n}\n","sourceCodeStart":872,"sourceCodeEnd":897,"githubUrl":"https://github.com/Automattic/mongoose/blob/49cdab01366679723b487ecb754b38570f783289/lib/helpers/populate/getModelsMapForPopulate.js#L872-L897","documentation":"Error \"Cannot use $where filter with populate() match\" thrown in Automattic/mongoose.","triggerScenarios":"Thrown at lib/helpers/populate/getModelsMapForPopulate.js:890 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"49cdab01366679723b487ecb754b38570f783289","analyzedAt":"2026-08-21T22:54:00.882Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}