# CVE-2026-118383: MongoDB Server use-after-free in replication catch-up

Source: https://junglewise.ai/threats/cve-2026-118383-a-use-after-free-in-the-replication-component-of-mongodb-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-118383 · Severity: critical · CVSS 9 · Published 2026-11-10

MongoDB Server, a widely-used database platform, contains a use-after-free vulnerability in its replication component that triggers when a newly elected replica set primary completes synchronization. An attacker without authentication can exploit this flaw to crash the database server or potentially execute arbitrary code within the server process, affecting all replica set configurations except standalone deployments.

Technologies: [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-118383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118383 being exploited in the wild.

**How severe is CVE-2026-118383?** Critical severity, with a CVSS score of 9, published 10 November 2026.

**Which products and versions are affected?** MongoDB Server all versions before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7.

**Is there a fix for CVE-2026-118383?** Yes: fixed in MongoDB Server 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118383 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-118383?** Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MongoDB Server 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7

## Technical details

A use-after-free vulnerability exists in CatchupState::abort() reentrancy within MongoDB's replication component, triggered by unauthenticated requests during replica set primary catch-up completion. The vulnerability affects replica set members including shard and config server replicas in sharded clusters; standalone mongod instances are not vulnerable. Exploitation can result in server termination or arbitrary code execution in the server process context.

## Affected products

- MongoDB Server all versions before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7

## Timeline

- 2026-11-10: disclosed: CVE-2026-118383 published
- 2026-11-10: patched: Fixed versions released across all supported branches

## References

- [https://jira.mongodb.org/browse/SERVER-138119](https://jira.mongodb.org/browse/SERVER-138119)
- [https://jira.mongodb.org/browse/SERVER-138175](https://jira.mongodb.org/browse/SERVER-138175)

## Related threats

- [MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of)
- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)
- [MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server)