Executive brief
A security vulnerability has been identified in MongoDB Server's JavaScript engine, which is used for processing complex database queries. An authorized user with basic read access could exploit this flaw to crash the database service or potentially access sensitive information stored in the server's memory. This could lead to service outages and unauthorized data exposure within the corporate environment.
Technical details
A use-after-free vulnerability exists in the MongoDB MozJS BSON binding layer due to inconsistent ownership semantics between the 'bsonObjToArray' and 'bsonGetImmutable' functions. Specifically, 'bsonObjToArray' fails to ensure the BSON object is properly owned before creating JavaScript wrappers, leading to memory corruption when operating on sub-document wrappers. An authenticated attacker with read privileges can trigger this via server-side JavaScript execution (e.g., using $where or $function operators). Successful exploitation allows the attacker to access freed memory, resulting in the disclosure of mongod process memory or a server crash (DoS). The issue has been addressed in multiple maintenance releases including 8.0.26, 7.0.37, and 6.0.29.
Affected products
- MongoDB MongoDB Server 4.4.31, 5.0.34, 6.0.29, 7.0.37, 8.0.26, 8.2.11, 8.3.4
Timeline
- 2026-06-02: other: Issue reported internally in MongoDB Jira
- 2026-06-11: patched: Fix resolved in development branch
- 2026-06-12: disclosed: CVE published and NVD record created