A patch release that never says the word “security” just closed four real security gaps in Mongoid. If your Rails app runs on MongoDB, 7.6.2 is the kind of release that’s easy to auto-merge and easy to regret not reading first.
Unbounded Regex Execution
In-memory queries, the ones run against embedded associations, evaluate in the calling thread. Before 7.6.2, a crafted regular expression could burn CPU indefinitely there. That’s a ReDoS vector: one bad regex, one thread pegged.
The fix is a new setting, Mongoid.in_memory_regexp_time_limit, defaulting to 5 seconds. Cross it and Mongoid raises Mongoid::Errors::InMemoryRegexpTimeout instead of letting the query run forever.
String $where Queries, Rejected by Default
Pass a raw String to #where and Mongoid used to hand it straight to MongoDB as a $where expression, JavaScript that executes server-side. That’s now off by default. Mongoid.allow_unsafe_query_operators defaults to false, and Mongoid raises Mongoid::Errors::InvalidQuery unless you explicitly opt back in.
JavaScript Operators, Blocked at Any Nesting Depth
This is the bigger of the two query fixes. $where, $function, and $accumulator are now blocked everywhere a query selector can appear, not just at the top level, across every criterion-building method Mongoid ships: where, find_by, or, and, nor, not, any_of, none_of, elem_match. Nested expressions like {'$expr' => {'$function' => ...}} get inspected too.
If your app has ever built a query from user input and passed it through one of those methods, this is the fix that closes the NoSQL injection path you may not have known was open.
Nested Attribute IDs, Resolved in the Right Association
An ID supplied through nested attributes used to fall back to a collection-wide lookup that ignored default scopes. That let a request reference, or destroy, a document outside the association it belonged to. Mongoid now resolves the ID within the caller’s actual association and raises Mongoid::Errors::DocumentNotFound for anything outside it. A new Mongoid.allow_reparenting_via_nested_attributes option (default false) exists if you were relying on the old behavior on purpose.
A fifth, smaller fix rounds it out: in-memory queries now read field names from the query as data instead of dispatching them as method calls on the document. One more code-injection-adjacent path, closed.
The Clock Is Also Running on Mongoid 7.x
Separate from the security fixes: Mongoid 7.x reaches end of life on December 31, 2026. No maintenance or security patches land on 7.x after that date. If you’re on Mongoid 7 or earlier, grab 7.6.2 now and put the upgrade to a supported line on your calendar.
How Scout Sees What Changes After You Upgrade
Scout Monitoring traces the database queries your Rails app runs in production, including the Mongoid calls that build the where, find_by, and or clauses this release just locked down. If tightening those query paths changes a query pattern, or a slow query shows up that wasn’t there before, Scout surfaces it in the same trace view you’re already using to debug performance, not a separate security dashboard you have to remember to check.
bundle update mongoid gets most Rails apps already on 7.6.x to the fix. If you’re further behind, on 7.5 or earlier, factor the EOL date into your upgrade plan now.
For application monitoring with errors, logs, and traces, Scout Monitoring provides the fastest insights without the bloat.