Problem

Using mongoose.Types.ObjectId.isValid to check if an ObjecId is valid and not a random string will return TRUE for any string of 12 bytes, this could be catastrophic.

Solution

To solve this, I suggest you create a new ObjectId using the string, then compare the results. ObjectId will always return thesame value if its a true