Passing req.params/query/body straight into a Mongo query lets an attacker inject operators ($ne, $gt, $where) to bypass auth or exfiltrate data.
Cast/validate user input to the expected scalar type before using it in a query; reject object-valued fields where a string is expected.